[Webkit-unassigned] [Bug 109129] [V8] Assertion failure on an exception is thrown

Wed Feb 6 20:53:19 PST 2013

https://bugs.webkit.org/show_bug.cgi?id=109129


--- Comment #1 from Hajime Morrita <morrita at google.com>  2013-02-06 20:55:27 PST ---
The repro above was wrong. This one should work:
---
<!DOCTYPE html>
<html>
<body>
<div id="container"></div>
<script>
if (window.testRunner)
    window.testRunner.dumpAsText();
window.onerror = function(message) { console.log(message); }

Object.defineProperty(Object.prototype, "prototype", {
    get: function() { console.log("FAIL"); },
    set: function() { console.log("FAIL"); }
});

Object.defineProperty(Object.prototype, "constructor", {
    get: function() { console.log("FAIL"); },
    set: function() { console.log("FAIL"); }
});

throw 1;
</script>
</body>
</html>
----

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.