deps/v8/test/mjsunit/regress/regress-crbug-1224142.js


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20

// Copyright 2021 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.

function main() {
  function test(v9,v10) {
    const v14 = async (v15,v16,v17) => {
      function v19() {
        JSON.stringify(this);
        v17(test);
      }
      Object.defineProperty(v17,v16,v10);
      new Promise(v19);
    }
    v9.__proto__.__proto__ = new Proxy(test, {get: v14})
  }
  test(isFinite,{});
  undefined_function();
}
assertThrows(main);