5a4b8084b8
The originally checked in regression test (https://chromium-review.googlesource.com/c/v8/v8/+/1034210/3/test/mjsunit/es6/regress/regress-7706.js) didn't actually reproduce the bug. BUG=v8:7706 R=gsathya@chromium.org, bmeurer@chromium.org Change-Id: I991c91d5a7f15419e388cb5133a281cf7f51736a Reviewed-on: https://chromium-review.googlesource.com/1036108 Reviewed-by: Sathya Gunasekaran <gsathya@chromium.org> Commit-Queue: Caitlin Potter <caitp@igalia.com> Cr-Commit-Position: refs/heads/master@{#52894}
17 lines
503 B
JavaScript
17 lines
503 B
JavaScript
// Copyright 2018 the V8 project authors. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style license that can be
|
|
// found in the LICENSE file.
|
|
|
|
// Flags: --allow-natives-syntax
|
|
|
|
class Test extends Number {}
|
|
Test.prototype[Symbol.toStringTag] = "Test";
|
|
|
|
function toString(o) {
|
|
%ToFastProperties(o.__proto__);
|
|
return Object.prototype.toString.call(o);
|
|
}
|
|
|
|
assertEquals("[object Test]", toString(new Test), "Try #1");
|
|
assertEquals("[object Test]", toString(new Test), "Try #2");
|