v8/test/mjsunit/regress/regress-crbug-504729.js
binji e291b78a8e Fix cluster-fuzz found regression in d8 Workers.
This one occurs when Function.prototype.toString is overridden to return a
non-string.

BUG=chromium:504729
R=mstarzinger@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/1214803004

Cr-Commit-Position: refs/heads/master@{#29351}
2015-06-29 15:53:22 +00:00

10 lines
313 B
JavaScript

// Copyright 2015 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
if (this.Worker) {
Function.prototype.toString = "foo";
function __f_7() {}
assertThrows(function() { var __v_5 = new Worker(__f_7); });
}