v8/test/mjsunit/regress/regress-5780.js
adamk 23019c4ec0 Object.prototype.toString must reflect mutated @@toStringTag values for primitives
The TF version of this operation was missing a ToObject coercion, so failed to do
@@toStringTag lookups when passed primitive values.

R=franzih@chromium.org
BUG=v8:5780

Review-Url: https://codereview.chromium.org/2597323002
Cr-Commit-Position: refs/heads/master@{#41961}
2016-12-27 17:57:38 +00:00

17 lines
647 B
JavaScript

// Copyright 2016 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
function testMutatedPrimitiveToStringTag(primitive) {
Object.defineProperty(
primitive.__proto__, Symbol.toStringTag,
{value: "bogus", configurable: true, writable: false, enumerable: false});
assertEquals("[object bogus]", Object.prototype.toString.call(primitive));
}
testMutatedPrimitiveToStringTag('');
testMutatedPrimitiveToStringTag(true);
testMutatedPrimitiveToStringTag(42);
testMutatedPrimitiveToStringTag(42.42);
testMutatedPrimitiveToStringTag(Symbol());