bd5e4b215c
We have a bug report from 2018 that no longer reproduces on ToT. This CL adds a regression bug regardless to make sure we don't re-introduce the bug that got fixed as a side-effect. R=kimanh@chromium.org Fixed: chromium:1246896 Change-Id: I8f9fdcbf7051b23e03cbbfc572771a410f70ad37 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3822668 Reviewed-by: Kim-Anh Tran <kimanh@chromium.org> Commit-Queue: Simon Zünd <szuend@chromium.org> Cr-Commit-Position: refs/heads/main@{#82372}
50 lines
1.2 KiB
Plaintext
50 lines
1.2 KiB
Plaintext
Don't crash when getting the properties of a native function
|
|
{
|
|
internalProperties : [
|
|
[0] : {
|
|
name : [[Prototype]]
|
|
value : {
|
|
className : Function
|
|
description : function () { [native code] }
|
|
objectId : <objectId>
|
|
type : function
|
|
}
|
|
}
|
|
[1] : {
|
|
name : [[Scopes]]
|
|
value : {
|
|
className : Array
|
|
description : Scopes[0]
|
|
objectId : <objectId>
|
|
subtype : internal#scopeList
|
|
type : object
|
|
}
|
|
}
|
|
]
|
|
result : [
|
|
[0] : {
|
|
configurable : true
|
|
enumerable : false
|
|
isOwn : true
|
|
name : length
|
|
value : {
|
|
description : 2
|
|
type : number
|
|
value : 2
|
|
}
|
|
writable : false
|
|
}
|
|
[1] : {
|
|
configurable : true
|
|
enumerable : false
|
|
isOwn : true
|
|
name : name
|
|
value : {
|
|
type : string
|
|
value : slice
|
|
}
|
|
writable : false
|
|
}
|
|
]
|
|
}
|