271ffdb0f7
The backing store fixed array for collections needs to be allocated in LOS if it exceeds the maximum regular heap object size. Drive-by-fix: Only store fixed array map once as per TODO. Bug: chromium:784862 Change-Id: I6b4dd2e45153ae107171e21bc7448e0d9b54b0ed Reviewed-on: https://chromium-review.googlesource.com/771150 Reviewed-by: Sathya Gunasekaran <gsathya@chromium.org> Commit-Queue: Jakob Gruber <jgruber@chromium.org> Cr-Commit-Position: refs/heads/master@{#49378}
11 lines
397 B
JavaScript
11 lines
397 B
JavaScript
// Copyright 2017 the V8 project authors. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style license that can be
|
|
// found in the LICENSE file.
|
|
|
|
// This test triggers table allocation in large object space. We don't care
|
|
// about the result as long as we don't crash.
|
|
const array = new Array();
|
|
array[0x80000] = 1;
|
|
array.unshift({});
|
|
assertThrows(() => new WeakMap(array));
|