5531a74be6
Bug: chromium:1224142 Change-Id: I42ed4ad23057837972cdbebb10e861948da9ddb2 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3017813 Auto-Submit: Igor Sheludko <ishell@chromium.org> Commit-Queue: Toon Verwaest <verwaest@chromium.org> Reviewed-by: Toon Verwaest <verwaest@chromium.org> Cr-Commit-Position: refs/heads/master@{#75682}
21 lines
533 B
JavaScript
21 lines
533 B
JavaScript
// Copyright 2021 the V8 project authors. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style license that can be
|
|
// found in the LICENSE file.
|
|
|
|
function main() {
|
|
function test(v9,v10) {
|
|
const v14 = async (v15,v16,v17) => {
|
|
function v19() {
|
|
JSON.stringify(this);
|
|
v17(test);
|
|
}
|
|
Object.defineProperty(v17,v16,v10);
|
|
new Promise(v19);
|
|
}
|
|
v9.__proto__.__proto__ = new Proxy(test, {get: v14})
|
|
}
|
|
test(isFinite,{});
|
|
undefined_function();
|
|
}
|
|
assertThrows(main);
|