v8/test/mjsunit/regress/regress-4769.js
neis 0ad44590e0 [json] Fix iteration over object keys in InternalizeJSONProperty.
We must not use for-of since that could be observed.

R=yangguo@chromium.org
BUG=v8:4769
LOG=n

Review URL: https://codereview.chromium.org/1748633002

Cr-Commit-Position: refs/heads/master@{#34387}
2016-03-01 11:53:28 +00:00

13 lines
443 B
JavaScript

// Copyright 2016 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// https://bugs.chromium.org/p/v8/issues/detail?id=4769
Object.getPrototypeOf([])[Symbol.iterator] = () => assertUnreachable();
JSON.stringify({foo: [42]});
JSON.stringify({foo: [42]}, []);
JSON.stringify({foo: [42]}, undefined, ' ');
JSON.stringify({foo: [42]}, [], ' ');