v8/test/mjsunit/regress/regress-v8-13037.js
jameslahm 752872d0c9 [runtime] Check if proxy has been revoked in ObjectToString
We could throw proxy revoked error before calling
Array.IsArray to make error message clearer.

Bug: v8:13037
Change-Id: I85055d24c833acd25791ef7a8a394955805ff3f1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3813065
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: 王澳 <wangao.james@bytedance.com>
Cr-Commit-Position: refs/heads/main@{#82251}
2022-08-08 09:37:02 +00:00

10 lines
370 B
JavaScript

// Copyright 2022 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
var r = Proxy.revocable({}, {});
r.revoke();
assertThrows(() => {
Object.prototype.toString.call(r.proxy)
}, TypeError, "Cannot perform 'Object.prototype.toString' on a proxy that has been revoked");