18dc491c7a
Previously, FrameFunctionIterator::next() assumed that the frame summary was non-empty. It's now possible for the list not to be empty, if the JS microtask pump invokes a builtin function which uses FrameFunctionIterator directly. While this is unlikely to show up in real world code, it is necessary to handle it to prevent crashes. BUG=chromium:794744 R=mstarzinger@chromium.org, cbruni@chromium.org, verwaest@chromium.org Change-Id: Ie95c2228544f57730d1c6c1ff955b2c94ff1c06b Reviewed-on: https://chromium-review.googlesource.com/833266 Reviewed-by: Camillo Bruni <cbruni@chromium.org> Commit-Queue: Caitlin Potter <caitp@igalia.com> Cr-Commit-Position: refs/heads/master@{#50221} |
||
|---|---|---|
| .. | ||
| regress | ||
| async-arrow-lexical-arguments.js | ||
| async-arrow-lexical-new.target.js | ||
| async-arrow-lexical-super.js | ||
| async-arrow-lexical-this.js | ||
| async-await-basic.js | ||
| async-await-no-constructor.js | ||
| async-await-resolve-new.js | ||
| async-await-species.js | ||
| async-destructuring.js | ||
| async-function-stacktrace.js | ||
| async-function-try-finally.js | ||
| constructor-returning-primitive.js | ||
| object-entries.js | ||
| object-get-own-property-descriptors.js | ||
| object-values.js | ||
| sloppy-no-duplicate-async.js | ||