e34f536620
This correctly marks the {JSCreate} operator as potentially throwing,
since it might trigger a property access of the 'prototype' property
during instantiation. This is observable, can throw (not kNoThrow),
might have side-effects (not kNoWrite), or even trigger a lazy deopt
event (not kNoDeopt). The inlining logic has been adapted to wire up
control projections accordingly.
Note that this does not yet take care of the "after" frame-state which
is associated with the {JSCreate} node introduced by the inliner. We
still might re-evaluate the property access upon lazy deoptimization.
R=bmeurer@chromium.org
TEST=mjsunit/regress/regress-5638
BUG=v8:5638
Review-Url: https://codereview.chromium.org/2671203003
Cr-Commit-Position: refs/heads/master@{#42981}
33 lines
731 B
JavaScript
33 lines
731 B
JavaScript
// Copyright 2017 the V8 project authors. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style license that can be
|
|
// found in the LICENSE file.
|
|
|
|
// Flags: --allow-natives-syntax
|
|
|
|
class MyErrorA {}
|
|
|
|
class MyErrorB {}
|
|
|
|
class A {}
|
|
|
|
class B extends A {
|
|
constructor() {
|
|
try {
|
|
super();
|
|
} catch (e) {
|
|
throw new MyErrorB();
|
|
}
|
|
}
|
|
}
|
|
|
|
var thrower = new Proxy(A, {
|
|
get(target, property, receiver) {
|
|
if (property === 'prototype') throw new MyErrorA();
|
|
}
|
|
});
|
|
|
|
assertThrows(() => Reflect.construct(B, [], thrower), MyErrorB);
|
|
assertThrows(() => Reflect.construct(B, [], thrower), MyErrorB);
|
|
%OptimizeFunctionOnNextCall(B);
|
|
assertThrows(() => Reflect.construct(B, [], thrower), MyErrorB);
|