Make sure error message formatting does not have side effects.

R=vegorov@chromium.org
BUG=

Review URL: https://chromiumcodereview.appspot.com/11598011

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13228 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

diff --git a/src/messages.js b/src/messages.js
index 2cb778fc13c1fbc7b2e7991acda618f9389430ac..0bfaf6c6118f636e45a029d0e5dabc4ec02c3ae5 100644 (file)
--- a/src/messages.js
+++ b/src/messages.js
@@ -192,7 +192,7 @@ function NoSideEffectToString(obj) {
   if (IS_NULL(obj)) return 'null';
   if (IS_FUNCTION(obj)) return  %_CallFunction(obj, FunctionToString);
   if (IS_OBJECT(obj) && %GetDataProperty(obj, "toString") === ObjectToString) {
-    var constructor = obj.constructor;
+    var constructor = %GetDataProperty(obj, "constructor");
     if (typeof constructor == "function") {
       var constructorName = constructor.name;
       if (IS_STRING(constructorName) && constructorName !== "") {

diff --git a/test/mjsunit/error-tostring.js b/test/mjsunit/error-tostring.js
index a28564144f8bcd4267a27dc1e4a9f797d68ab74f..8a8a969085124a7d5353431cc9a941b01385c7e7 100644 (file)
--- a/test/mjsunit/error-tostring.js
+++ b/test/mjsunit/error-tostring.js
@@ -83,3 +83,11 @@ assertEquals(["Error: e2",[1,3,4]], testErrorToString(undefined, "e2"));
 assertEquals(["null: e2",[1,2,3,4]], testErrorToString(null, "e2"));
 assertEquals(["e2",[1,2,3,4]], testErrorToString("", "e2"));
 assertEquals(["e1: e2",[1,2,3,4]], testErrorToString("e1", "e2"));
+
+var obj = {
+  get constructor () {
+    assertUnreachable();
+  }
+};
+
+assertThrows(function() { obj.x(); });