v8/test/mjsunit/regress/regress-796427.js
peterwmwong bd1f8050b0 [builtins] Add Object#toLocaleString stack check
Fixes a regression causing a seg fault instead of the
expected stack overflow.

Bug: chromium:796427, v8:6005
Change-Id: Ifc752a4009a25f447f5e87745dcc1bb83722c34e
Reviewed-on: https://chromium-review.googlesource.com/838854
Commit-Queue: Peter Wong <peter.wm.wong@gmail.com>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50265}
2017-12-21 14:24:02 +00:00

8 lines
282 B
JavaScript

// Copyright 2017 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
//
// Flags: --stack-size=150
assertThrows(() => "" + { toString: Object.prototype.toLocaleString }, RangeError);