// Copyright 2017 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.

// Flags: --expose-gc --enable-slow-asserts

a = new Proxy([], {
  defineProperty() {
    b.length = 1; gc();
    return Object.defineProperty.apply(this, arguments);
  }
});

class MyArray extends Array {
  static get[Symbol.species](){
    return function() {
      return a;
    }
  };
}

b = new MyArray(65535);
b[1] = 0.1;
c = Array.prototype.concat.call(b);
gc();