Index: test/mjsunit/regexp.js |
diff --git a/test/mjsunit/regexp.js b/test/mjsunit/regexp.js |
index fd698967c4e4526b9310632496a1bf77e5e99f38..beed6cd30f23224bada5ca703b2ba1a59834d249 100644 |
--- a/test/mjsunit/regexp.js |
+++ b/test/mjsunit/regexp.js |
@@ -741,9 +741,10 @@ assertThrows(() => "abc".replace(/./, "")); |
RegExp.prototype.exec = RegExpPrototypeExec; |
// Test the code path in RE.proto[@@search] when previousLastIndex is a receiver |
-// but can't be converted to a primitive. This exposed a crash in the |
-// C++ implementation of @@search. |
+// but can't be converted to a primitive. This exposed a crash in an older |
+// C++ implementation of @@search which a) still relied on Object::Equals, |
+// and b) incorrectly returned isolate->pending_exception() on error. |
var re = /./; |
re.lastIndex = { [Symbol.toPrimitive]: 42 }; |
-() => "abc".search(re); |
+try { "abc".search(re); } catch (_) {} // Ensure we don't crash. |