v8/test/mjsunit/regress/regress-814643.js

// Copyright 2018 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.

Number.prototype.__proto__ = String.prototype;
Uint8Array.from(1);
[typedarray] Fix IterableToList when Number has an iterator IterableToListCanBeElided checked that the input was always a HeapObject but this is not true when an iterator symbol is defined on the Number prototype, meaning Smi and HeapNumber can also be passed in. Added a regression test for the crash and some correctness tests for smi and double input to TA.from. Also factored out the tests in typedarray-from.js that modify global state e.g. protector cells, so that one iteration of the top level loop does not interfere with the next. Bug: chromium:814643 Change-Id: I364d11f011faf8370446f905a35a945d47e4477f Reviewed-on: https://chromium-review.googlesource.com/930962 Reviewed-by: Jakob Gruber <jgruber@chromium.org> Commit-Queue: Peter Marshall <petermarshall@chromium.org> Cr-Commit-Position: refs/heads/master@{#51461} 2018-02-22 09:48:50 +00:00			`// Copyright 2018 the V8 project authors. All rights reserved.`
			`// Use of this source code is governed by a BSD-style license that can be`
			`// found in the LICENSE file.`

			`Number.prototype.__proto__ = String.prototype;`
			`Uint8Array.from(1);`