diff --git a/src/elements.cc b/src/elements.cc index 499af83078..373af84433 100644 --- a/src/elements.cc +++ b/src/elements.cc @@ -3339,7 +3339,8 @@ class TypedElementsAccessor // them. if (source_proto->IsNull(isolate)) return false; if (source_proto->IsJSProxy()) return true; - if (!context->is_initial_array_prototype(JSObject::cast(source_proto))) { + if (!context->native_context()->is_initial_array_prototype( + JSObject::cast(source_proto))) { return true; } diff --git a/test/mjsunit/regress/regress-804288.js b/test/mjsunit/regress/regress-804288.js new file mode 100644 index 0000000000..6f7855d68c --- /dev/null +++ b/test/mjsunit/regress/regress-804288.js @@ -0,0 +1,9 @@ +// Copyright 2018 the V8 project authors. All rights reserved. +// Use of this source code is governed by a BSD-style license that can be +// found in the LICENSE file. + +var arr = [{}]; +Object.setPrototypeOf(arr, {}); +var ta = new Uint8Array(arr); + +let kDeclNoLocals = 0;