cf53fed972
ArgumentsAdaptorStub for derived constructor (the one that needs new.target) works in this way: - If the constructor is invoked via the Construct stub, we know that actual arguments always include new.target. ``arguments`` object however should not include a new.target, therefore we remove it. We achieve this by decrementing the argument count. - If the constructor is invoked as a call, we do not care for a correct ``arguments`` array since the constructor will immediately throw on entrance. The bug is that the call could actually pass 0 actual arguments, but I decrement unconditionally :(. The fix is to detect this case and avoid decrementing. ``arguments`` is bogus, but it is ok as constructor throws. Long-term we should just remove mucking about with arguments for new.target and just get it from the stack. R=arv@chromium.org,rossberg@chromium.org BUG=chromium:474783 LOG=Y Review URL: https://codereview.chromium.org/1126783003 Cr-Commit-Position: refs/heads/master@{#28242}
25 lines
882 B
JavaScript
25 lines
882 B
JavaScript
// Copyright 2015 the V8 project authors. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style license that can be
|
|
// found in the LICENSE file.
|
|
|
|
|
|
"use strict";
|
|
class Base {
|
|
}
|
|
class Subclass extends Base {
|
|
constructor(a,b,c) {
|
|
arguments[1];
|
|
}
|
|
}
|
|
assertThrows(function() { Subclass(); }, TypeError);
|
|
assertThrows(function() { Subclass(1); }, TypeError);
|
|
assertThrows(function() { Subclass(1, 2); }, TypeError);
|
|
assertThrows(function() { Subclass(1, 2, 3); }, TypeError);
|
|
assertThrows(function() { Subclass(1, 2, 3, 4); }, TypeError);
|
|
|
|
assertThrows(function() { Subclass.call(); }, TypeError);
|
|
assertThrows(function() { Subclass.call({}); }, TypeError);
|
|
assertThrows(function() { Subclass.call({}, 1); }, TypeError);
|
|
assertThrows(function() { Subclass.call({}, 1, 2); }, TypeError);
|
|
assertThrows(function() { Subclass.call({}, 1, 2, 3, 4); }, TypeError);
|