v8/test/mjsunit/regress/regress-8133-2.js

18 lines
619 B
JavaScript
Raw Normal View History

// Copyright 2018 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
const arr = [1, , 3];
function mapper(x) {
Array.prototype[1] = 2;
return x + 1;
}
// We force a direct iteration (using the array length, not the iterator
// protocol). The mapper function gets called during this iteration, not in a
// separate one. Hence when index 1 is read, 2 is retrieved from the prototype
// and incremented to 3.
Array.prototype[Symbol.iterator] = undefined;
assertArrayEquals([2, 3, 4], Uint16Array.from(arr, mapper));