v8/test/mjsunit/regress/regress-726636.js
Sathya Gunasekaran 6b31174aec [Promise] Add smi check for species constructor
Bug: chromium:726636
Change-Id: Ied6af8c969ed05b7a334238b30930658af060e7d
Reviewed-on: https://chromium-review.googlesource.com/516734
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45537}
2017-05-26 11:18:37 +00:00

15 lines
396 B
JavaScript

// Copyright 2017 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
//
// Flags: --allow-natives-syntax
Object.defineProperty(Promise, Symbol.species, { value: 0 });
var p = new Promise(function() {});
try {
p.then();
assertUnreachable();
} catch(e) {
assertTrue(e instanceof TypeError);
}