40f8b099b1
The recent change crrev.com/c/2712755 got a bounds check wrong, causing an invalid use of the lookup iterator. Bug: v8:1185072 Change-Id: I3138d266cb4b2482dcb5078fb025bbfc43dd2940 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2742196 Commit-Queue: Igor Sheludko <ishell@chromium.org> Auto-Submit: Jakob Gruber <jgruber@chromium.org> Reviewed-by: Igor Sheludko <ishell@chromium.org> Cr-Commit-Position: refs/heads/master@{#73250}
27 lines
740 B
JavaScript
27 lines
740 B
JavaScript
// Copyright 2021 the V8 project authors. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style license that can be
|
|
// found in the LICENSE file.
|
|
|
|
function __getProperties(obj) {
|
|
let properties = [];
|
|
for (let name of Object.getOwnPropertyNames(obj)) {
|
|
properties.push(name);
|
|
}
|
|
return properties;
|
|
}
|
|
function __getRandomProperty(obj, seed) {
|
|
let properties = __getProperties(obj);
|
|
return properties[seed % properties.length];
|
|
}
|
|
let __v_19 = [];
|
|
class __c_0 extends Array {}
|
|
Object.defineProperty(__v_19, 'constructor', {
|
|
get() {
|
|
return __c_0;
|
|
}
|
|
});
|
|
Object.defineProperty(__v_19, __getRandomProperty(__v_19, 776790), {
|
|
value: 4294967295
|
|
});
|
|
assertThrows(() => __v_19.concat([1])[9], RangeError);
|