v8/test/mjsunit/regress/regress-crbug-584188.js
jkummerow 5d2c09a829 Fix Array.prototype.sort for *_STRING_WRAPPER_ELEMENTS
Trying to sort a string should throw a TypeError, proper handling
of elements just needs to get out of the way.

BUG=chromium:584188
LOG=n
R=cbruni@chromium.org

Review URL: https://codereview.chromium.org/1670153002

Cr-Commit-Position: refs/heads/master@{#33777}
2016-02-05 13:36:51 +00:00

11 lines
356 B
JavaScript

// Copyright 2016 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
var x = {};
try {
Object.defineProperty(String.prototype, "3", { x: function() { x = v; }});
string = "bla";
} catch(e) {; }
assertThrows("Array.prototype.sort.call(string);", TypeError);