09c41d9bfd
In addition to ThrowTypeError not being a constructor, it was invalidly set up by simply swapping the map. Swapping the map is insufficient since NewFunction* actually set up the function depending on the used map. BUG=chromium:573858 LOG=n Review URL: https://codereview.chromium.org/1552223002 Cr-Commit-Position: refs/heads/master@{#33082}
17 lines
552 B
JavaScript
17 lines
552 B
JavaScript
// Copyright 2016 the V8 project authors. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style license that can be
|
|
// found in the LICENSE file.
|
|
|
|
// Flags: --allow-natives-syntax
|
|
|
|
var throw_type_error = Object.getOwnPropertyDescriptor(
|
|
(function() {"use strict"}).__proto__, "caller").get;
|
|
|
|
function create_initial_map() { this instanceof throw_type_error }
|
|
%OptimizeFunctionOnNextCall(create_initial_map);
|
|
create_initial_map();
|
|
|
|
function test() { new throw_type_error }
|
|
%OptimizeFunctionOnNextCall(test);
|
|
assertThrows(test);
|