v8/test/mjsunit/regress/regress-816289.js

// Copyright 2018 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.

delete String.prototype[Symbol.iterator];
Int8Array.from("anything");
[typedarray] Extend ElementsAccessor::CopyElements to all Object types Previously, Strings without an iterator would go to the runtime path and fail on because it expected a JSReceiver type. This was in-line with what the elements accessor expected. We can actually handle all object types in the final slow path (using LookupIterator) so it is no problem to change the accept types. Bug: chromium:816289 Change-Id: Iebb8de0bb7551aee3894c8a23836d079c93726a7 Reviewed-on: https://chromium-review.googlesource.com/937461 Reviewed-by: Jakob Gruber <jgruber@chromium.org> Commit-Queue: Peter Marshall <petermarshall@chromium.org> Cr-Commit-Position: refs/heads/master@{#51574} 2018-02-26 15:14:56 +00:00			`// Copyright 2018 the V8 project authors. All rights reserved.`
			`// Use of this source code is governed by a BSD-style license that can be`
			`// found in the LICENSE file.`

			`delete String.prototype[Symbol.iterator];`
			`Int8Array.from("anything");`