v8/test/mjsunit/regress/regress-crbug-808192.js

// Copyright 2018 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.

// Flags: --expose-gc

const f = eval(`(function f(i) {
  if (i == 0) {
    class Derived extends Object {
      constructor() {
        super();
        ${"this.a=1;".repeat(0x3fffe-8)}
      }
    }
    return Derived;
  }

  class DerivedN extends f(i-1) {
    constructor() {
      super();
      ${"this.a=1;".repeat(0x40000-8)}
    }
  }

  return DerivedN;
})`);

let a = new (f(0x7ff))();
a.a = 1;
gc();
assertEquals(1, a.a);