38c901614e
Fix corner case where we would try to read a property when having a pending or scheduled exception. Re-add tests. Bug: chromium:1006640 Change-Id: I2fc84ee0f6145db2d200a8b9abf57fdc4b12a5a3 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1835531 Reviewed-by: Ulan Degenbaev <ulan@chromium.org> Commit-Queue: Michael Lippautz <mlippautz@chromium.org> Cr-Commit-Position: refs/heads/master@{#64083}
21 lines
589 B
JavaScript
21 lines
589 B
JavaScript
// Copyright 2019 the V8 project authors. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style license that can be
|
|
// found in the LICENSE file.
|
|
|
|
// Flags: --expose-gc
|
|
|
|
function main() {
|
|
const v2 = [1337,1337,1337,1337,1337];
|
|
function v9() {
|
|
const v15 = {get:RegExp};
|
|
Object.defineProperty(v2,501,v15);
|
|
const v18 = RegExp();
|
|
const v19 = 1337 instanceof v18;
|
|
}
|
|
const v30 = {defineProperty:Function,get:v9,getPrototypeOf:Object};
|
|
const v32 = new Proxy(ArrayBuffer,v30);
|
|
const v34 = gc(v32);
|
|
}
|
|
|
|
assertThrows(() => main(), TypeError);
|