v8/test/mjsunit/regress/regress-crbug-1206289.js
Emanuel Ziegler 9f7cbe9b4e Add regression test for http://crbug/1206289
Bug: chromium:1206289
Change-Id: Ib0cc2a0d159b763efa4fe33502b0a6562973b430
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3429501
Reviewed-by: Lutz Vahl <vahl@chromium.org>
Commit-Queue: Lutz Vahl <vahl@chromium.org>
Cr-Commit-Position: refs/heads/main@{#78899}
2022-02-02 09:32:55 +00:00

23 lines
574 B
JavaScript

// Copyright 2021 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --expose-gc --stress-flush-bytecode
function outer() {
function asm_broken(a, import_obj) {
"use asm";
// import_obj is expected to be an object and this causes
// asm_wasm_broken to be set to true when instantiating at runtime.
var v = import_obj.x;
function inner() {
}
return inner;
}
var m = asm_broken();
}
assertThrows(outer);
gc();
assertThrows(outer);