7cd01ed3c1
Typed array iteration throws a TypeError if the receiver is not a typed array. The JSCallReducer didn't take that into account. Bug: chromium:1067544 Change-Id: Ib065ba1b7881dc0b62242fc416fa16023a7fa244 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2135632 Reviewed-by: Maya Lekova <mslekova@chromium.org> Commit-Queue: Georg Neis <neis@chromium.org> Auto-Submit: Georg Neis <neis@chromium.org> Cr-Commit-Position: refs/heads/master@{#67010}
17 lines
438 B
JavaScript
17 lines
438 B
JavaScript
// Copyright 2020 the V8 project authors. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style license that can be
|
|
// found in the LICENSE file.
|
|
|
|
// Flags: --allow-natives-syntax
|
|
|
|
const v = [];
|
|
function foo() {
|
|
Int8Array.prototype.values.call([v]);
|
|
}
|
|
|
|
%PrepareFunctionForOptimization(foo);
|
|
assertThrows(foo, TypeError);
|
|
assertThrows(foo, TypeError);
|
|
%OptimizeFunctionOnNextCall(foo);
|
|
assertThrows(foo, TypeError);
|