9cc672911f
+ additional fixes uncovered by bug, and addressed remaining feedback from original CL (https://codereview.chromium.org/2806073002/). Note that the regression test differs slightly from the bug reported one, in that it catches the RangeError which will eventually be thrown due to call stack size being exceeded. BUG=chromium:712569 Review-Url: https://codereview.chromium.org/2825073002 Cr-Commit-Position: refs/heads/master@{#44700}
21 lines
463 B
JavaScript
21 lines
463 B
JavaScript
// Copyright 2017 the V8 project authors. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style license that can be
|
|
// found in the LICENSE file.
|
|
//
|
|
|
|
var v11 = {};
|
|
Object.defineProperty(v11.__proto__, 0, {
|
|
get: function() {
|
|
},
|
|
set: function() {
|
|
try {
|
|
WebAssembly.instantiate();
|
|
v11[0] = 0;
|
|
} catch (e) {
|
|
assertTrue(e instanceof RangeError);
|
|
}
|
|
}
|
|
});
|
|
v66 = new Array();
|
|
cv = v66; cv[0] = 0.1; cv[2] = 0.2;
|