Status: Accepted
Owner: [email protected]
CC: [email protected], [email protected]
Labels: Type-Bug Priority-Medium V8Fuzzer
New issue 2284 by [email protected]: Calling %constructor() on the
builtins global object causes crashes
http://code.google.com/p/v8/issues/detail?id=2284
The "constructor" property on prototype of the builtins global object is
set to a constructor function with illegal code. Calls to this property
don't throw a TypeError but will crash if natives syntax is allowed. The
following is the reduced test case.
// Flags: --allow-natives-syntax
assertThrows("%constructor();", TypeError);
assertThrows("%constructor(23);", TypeError);
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
