v8/test/mjsunit/regress/regress-685086.js
petermarshall bf782ec512 [Builtins] Smi-check the spread and go to runtime in CheckSpreadAndPushToStack.
We did not smi-check the spread argument here, meaning we tried to take the map
of a smi, resulting in segfaults which clusterfuzz found.

Also added tests that exercise this path.

BUG=685086

Review-Url: https://codereview.chromium.org/2655013002
Cr-Commit-Position: refs/heads/master@{#42657}
2017-01-25 13:55:58 +00:00

9 lines
208 B
JavaScript

// Copyright 2017 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
try {
Math.max(...0);
} catch (e) {
}