v8/test/mjsunit/regress/regress-4271.js
caitpotter88 c9007d8f7e [d8] bounds-check before getting Shell::Worker internal field
Prevents fatal error in debug builds

BUG=v8:4271, 506954
R=binji@chromium.org
LOG=N

Committed: https://crrev.com/43ce9c6f101c4224addd9a54e0c39963188dc7fa
Cr-Commit-Position: refs/heads/master@{#29524}

Review URL: https://codereview.chromium.org/1214053004

Cr-Commit-Position: refs/heads/master@{#29737}
2015-07-17 21:44:37 +00:00

25 lines
589 B
JavaScript

// Copyright 2015 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
if (this.Worker) {
// Throw rather than overflow internal field index
assertThrows(function() {
Worker.prototype.terminate();
});
assertThrows(function() {
Worker.prototype.getMessage();
});
assertThrows(function() {
Worker.prototype.postMessage({});
});
// Don't throw for real worker
var worker = new Worker('');
worker.getMessage();
worker.postMessage({});
worker.terminate();
}