40dd065823
The catch prediction logic got confused when we merged the reactions and result fields of JSPromise, because for settled promises it would start to treat the result as reactions list, leading to a crash most likely or memory corruption in the worst case (only if break on uncaught exception is enabled). We can only inspect reactions when the promise is still in "pending" state. Bug: chromium:808973, v8:7253 Change-Id: I15162c96fce959a052fbc628addd9418da39327c Reviewed-on: https://chromium-review.googlesource.com/903163 Reviewed-by: Jakob Gruber <jgruber@chromium.org> Commit-Queue: Benedikt Meurer <bmeurer@chromium.org> Cr-Commit-Position: refs/heads/master@{#51106} |
||
---|---|---|
.. | ||
bugs/harmony | ||
debug | ||
protocol | ||
regress | ||
wrapper | ||
debugger.isolate | ||
debugger.status | ||
test-api.js | ||
testcfg.py |