[Webkit-unassigned] [Bug 109129] New: [V8] Assertion failure on an exception is thrown

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=109129

           Summary: [V8] Assertion failure on an exception is thrown
           Product: WebKit
           Version: 528+ (Nightly build)
          Platform: Unspecified
        OS/Version: Unspecified
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: WebCore JavaScript
        AssignedTo: webkit-unassigned at lists.webkit.org
        ReportedBy: morrita at google.com
                CC: haraken at chromium.org


Repro:
----
<script>

Object.defineProperty(Object.prototype, "prototype", {
    get: function() { console.log("FAIL"); },
    set: function() { console.log("FAIL"); }
});

Object.defineProperty(Object.prototype, "constructor", {
    get: function() { console.log("FAIL"); },
    set: function() { console.log("FAIL"); }
});

throw 1;
</script>
----

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.