3d66e5d1d7
These checks ensure that a TypeError is thrown, per spec, rather than a runtime assert failure. BUG=v8:4964 R=adamk LOG=Y Review-Url: https://codereview.chromium.org/1929123002 Cr-Commit-Position: refs/heads/master@{#35885}
23 lines
653 B
JavaScript
23 lines
653 B
JavaScript
// Copyright 2016 the V8 project authors. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style license that can be
|
|
// found in the LICENSE file.
|
|
|
|
// Flags: --allow-natives-syntax
|
|
|
|
// Neutered source
|
|
var ab = new ArrayBuffer(10);
|
|
ab.constructor = { get [Symbol.species]() { %ArrayBufferNeuter(ab); return ArrayBuffer; } };
|
|
assertThrows(() => ab.slice(0), TypeError);
|
|
|
|
// Neutered target
|
|
class NeuteredArrayBuffer extends ArrayBuffer {
|
|
constructor(...args) {
|
|
super(...args);
|
|
%ArrayBufferNeuter(this);
|
|
}
|
|
}
|
|
|
|
var ab2 = new ArrayBuffer(10);
|
|
ab2.constructor = NeuteredArrayBuffer;
|
|
assertThrows(() => ab2.slice(0), TypeError);
|