v8/test/mjsunit/regress-918763.js
Jaroslav Sevcik 426312c88e [turbofan] Add missing heap object check
Bug: chromium:918763
Change-Id: Ic9faaed6b3194269748ba35740cda0dc8dde3241
Reviewed-on: https://chromium-review.googlesource.com/c/1397707
Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58589}
2019-01-07 14:38:50 +00:00

15 lines
345 B
JavaScript

// Copyright 2019 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --allow-natives-syntax
function C() {}
C.__proto__ = null;
function f(c) { return 0 instanceof c; }
f(C);
%OptimizeFunctionOnNextCall(f);
assertThrows(() => f(0));