| Index: test/mjsunit/regexp.js
|
| diff --git a/test/mjsunit/regexp.js b/test/mjsunit/regexp.js
|
| index fd698967c4e4526b9310632496a1bf77e5e99f38..beed6cd30f23224bada5ca703b2ba1a59834d249 100644
|
| --- a/test/mjsunit/regexp.js
|
| +++ b/test/mjsunit/regexp.js
|
| @@ -741,9 +741,10 @@ assertThrows(() => "abc".replace(/./, ""));
|
| RegExp.prototype.exec = RegExpPrototypeExec;
|
|
|
| // Test the code path in RE.proto[@@search] when previousLastIndex is a receiver
|
| -// but can't be converted to a primitive. This exposed a crash in the
|
| -// C++ implementation of @@search.
|
| +// but can't be converted to a primitive. This exposed a crash in an older
|
| +// C++ implementation of @@search which a) still relied on Object::Equals,
|
| +// and b) incorrectly returned isolate->pending_exception() on error.
|
|
|
| var re = /./;
|
| re.lastIndex = { [Symbol.toPrimitive]: 42 };
|
| -() => "abc".search(re);
|
| +try { "abc".search(re); } catch (_) {} // Ensure we don't crash.
|
|
|