Check whether the receiver to a keyed-call is actually a heapobject.

test/mjsunit/regress/regress-crbug-325225.js

Index: test/mjsunit/regress/regress-crbug-325225.js
diff --git a/test/mjsunit/regress/regress-crbug-217858.js b/test/mjsunit/regress/regress-crbug-325225.js
similarity index 90%
copy from test/mjsunit/regress/regress-crbug-217858.js
copy to test/mjsunit/regress/regress-crbug-325225.js
index e61cb9f6d24a6dcb54a81699183d2db843d0d2dc..d0aeb0576d6e36731d403c3475a79462e72bdbc9 100644
--- a/test/mjsunit/regress/regress-crbug-217858.js
+++ b/test/mjsunit/regress/regress-crbug-325225.js
@@ -25,13 +25,12 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
-// Flags: --noanalyze_environment_liveness
+try {
+  function f(a) { a[0](0); } f([f]);
 
-var r = /r/;
-function f() {
-  r[r] = function() {};
-}
+  function f2(a) {
+    a[0](true);
+  }
 
-for (var i = 0; i < 300000; i++) {
-  f();
-}
+  f2([function(a) { return f2("undefined", typeof f2(42, 0)); }]);
+} catch (e) { }

[Dmitry Lomov (no reviews), 2013/12/03 17:52:05]

Separate try-catches, also assertThrow