Commit 29dc4898 authored by kozyatinskiy's avatar kozyatinskiy Committed by Commit bot

[inspector] fixed crash in InternalPromiseHasUserDefinedRejectHandler

Method should be ready to symbols inside of queue_arr.

BUG=v8:6168
R=gsathya@chromium.org

Review-Url: https://codereview.chromium.org/2782893003
Cr-Commit-Position: refs/heads/master@{#44254}
parent 411efc16
......@@ -1930,13 +1930,20 @@ bool InternalPromiseHasUserDefinedRejectHandler(Isolate* isolate,
Handle<FixedArray> deferred_promise_arr =
Handle<FixedArray>::cast(deferred_promise);
for (int i = 0; i < deferred_promise_arr->length(); i++) {
Handle<JSReceiver> queue_item(JSReceiver::cast(queue_arr->get(i)));
Handle<JSReceiver> deferred_promise_item(
JSReceiver::cast(deferred_promise_arr->get(i)));
if (queue_arr->get(i)->IsSymbol()) {
if (InternalPromiseHasUserDefinedRejectHandler(
isolate, Handle<JSPromise>::cast(deferred_promise_item))) {
return true;
}
} else {
Handle<JSReceiver> queue_item(JSReceiver::cast(queue_arr->get(i)));
if (PromiseHandlerCheck(isolate, queue_item, deferred_promise_item)) {
return true;
}
}
}
return false;
}
......
......@@ -3,10 +3,6 @@
# found in the LICENSE file.
[
['mode == debug', {
# Issue 6168. Crash.
'runtime/await-promise': [SKIP],
}],
##############################################################################
['variant != default', {
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment