v8/test/mjsunit/regress/regress-crbug-1072947.js
Igor Sheludko a4cf332116 [runtime] Fix miscalculated number of properties for derived class
... when an error occurs during super constructor compilation.

Bug: chromium:1072947
Change-Id: I8acf461de1f3c141e45d3b61b3ac2f5c990e106a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2172964
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Auto-Submit: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67505}
2020-04-30 15:22:27 +00:00

32 lines
545 B
JavaScript

// Copyright 2020 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
(function() {
class reg extends RegExp {}
let r;
function trigger() {
try {
trigger();
} catch {
Reflect.construct(RegExp,[],reg);
}
}
trigger();
})();
(function() {
class reg extends Function {}
let r;
function trigger() {
try {
trigger();
} catch {
Reflect.construct(RegExp,[],reg);
}
}
trigger();
})();