cd778f13ac
A few tests that would be good to have to verify that the known manifestations of this bug are resolved. Previously, the async generator and async function tests would crash. The other ones never did, but still resulted in the register overwite bug. BUG=v8:6322 R=adamk@chromium.org Change-Id: Ic2238227629077de5671d67d18b3bfe018dd23f4 Reviewed-on: https://chromium-review.googlesource.com/514230 Reviewed-by: Adam Klein <adamk@chromium.org> Commit-Queue: Caitlin Potter <caitp@igalia.com> Cr-Commit-Position: refs/heads/master@{#45524}
12 lines
529 B
JavaScript
12 lines
529 B
JavaScript
// Copyright 2017 the V8 project authors. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style license that can be
|
|
// found in the LICENSE file.
|
|
|
|
// Crash with --verify-heap
|
|
(function*() { for (let { a = class b { } } of [{}]) { } })().next();
|
|
(function() { for (let { a = class b { } } of [{}]) { } })();
|
|
(function() { var a; for ({ a = class b { } } of [{}]) { } })();
|
|
|
|
(function() { for (let [a = class b { } ] = [[]]; ;) break; })();
|
|
(function() { var a; for ([a = class b { } ] = [[]]; ;) break; })();
|