aaa78c330e
IterableToListCanBeElided checked that the input was always a HeapObject but this is not true when an iterator symbol is defined on the Number prototype, meaning Smi and HeapNumber can also be passed in. Added a regression test for the crash and some correctness tests for smi and double input to TA.from. Also factored out the tests in typedarray-from.js that modify global state e.g. protector cells, so that one iteration of the top level loop does not interfere with the next. Bug: chromium:814643 Change-Id: I364d11f011faf8370446f905a35a945d47e4477f Reviewed-on: https://chromium-review.googlesource.com/930962 Reviewed-by: Jakob Gruber <jgruber@chromium.org> Commit-Queue: Peter Marshall <petermarshall@chromium.org> Cr-Commit-Position: refs/heads/master@{#51461}
7 lines
235 B
JavaScript
7 lines
235 B
JavaScript
// Copyright 2018 the V8 project authors. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style license that can be
|
|
// found in the LICENSE file.
|
|
|
|
Number.prototype.__proto__ = String.prototype;
|
|
Uint8Array.from(1);
|