d8f0237af2
Fixes V8 correctness failure when there's a proxy in the global object prototype chain and unsuccessful attempt is made to access a property. Bug: chromium:849024 Change-Id: I829e1a6c038982b7c7a77f8bdefb61facb4614f0 Reviewed-on: https://chromium-review.googlesource.com/1124446 Commit-Queue: Maya Lekova <mslekova@chromium.org> Reviewed-by: Igor Sheludko <ishell@chromium.org> Reviewed-by: Benedikt Meurer <bmeurer@chromium.org> Reviewed-by: Georg Neis <neis@chromium.org> Cr-Commit-Position: refs/heads/master@{#54237}
44 lines
753 B
JavaScript
44 lines
753 B
JavaScript
// Copyright 2018 the V8 project authors. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style license that can be
|
|
// found in the LICENSE file.
|
|
|
|
// Flags: --expose-gc
|
|
|
|
this.__proto__ = new Proxy({}, {});
|
|
|
|
function test1() {
|
|
eval("bla");
|
|
}
|
|
|
|
assertThrows(test1, ReferenceError);
|
|
assertThrows(test1, ReferenceError);
|
|
assertThrows(test1, ReferenceError);
|
|
|
|
function test2() {
|
|
gc();
|
|
eval("bla");
|
|
}
|
|
|
|
assertThrows(test2, ReferenceError);
|
|
assertThrows(test2, ReferenceError);
|
|
assertThrows(test2, ReferenceError);
|
|
|
|
function foo() {
|
|
try {
|
|
eval("bla");
|
|
} catch(e) {
|
|
return;
|
|
}
|
|
throw 1337;
|
|
}
|
|
|
|
function test3() {
|
|
gc();
|
|
foo();
|
|
foo();
|
|
}
|
|
|
|
assertDoesNotThrow(test3);
|
|
assertDoesNotThrow(test3);
|
|
assertDoesNotThrow(test3);
|