a07c14f679
When accessing a super property which is a getter, the receiver is not restricted the same way as when doing normal property access. In particular, the receiver can be null / undefined. Bug: v8:9237, chromium:1148758, v8:11161 Change-Id: Ic6bc2053e5d046d4b19e868312aa9b50025256a1 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2549941 Commit-Queue: Marja Hölttä <marja@chromium.org> Reviewed-by: Georg Neis <neis@chromium.org> Cr-Commit-Position: refs/heads/master@{#71281}
46 lines
704 B
JavaScript
46 lines
704 B
JavaScript
// Copyright 2020 the V8 project authors. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style license that can be
|
|
// found in the LICENSE file.
|
|
|
|
// Flags: --interrupt-budget=100
|
|
|
|
var caught = 0;
|
|
|
|
function runManyTimes(f) {
|
|
for (let i = 0; i < 1000; ++i) {
|
|
try {
|
|
// Seems to be important that this is inside a try catch.
|
|
f();
|
|
} catch (e) {
|
|
assertUnreachable();
|
|
}
|
|
}
|
|
}
|
|
|
|
let A = {
|
|
get foo() {
|
|
return 0;
|
|
}
|
|
};
|
|
|
|
let B = {
|
|
__proto__: A,
|
|
|
|
aa() {
|
|
"use strict";
|
|
super.foo;
|
|
}
|
|
};
|
|
|
|
var superAccessingFunc = B.aa;
|
|
|
|
runManyTimes(function () {
|
|
try {
|
|
superAccessingFunc();
|
|
} catch (e) {
|
|
caught++;
|
|
}
|
|
});
|
|
|
|
assertEquals(0, caught);
|