e00dd8ebe1
We assumed that every JSArray would have a JSObject as a prototype, but it could be null, in which case we bail out to slow path. Also rename spread_array variable here, because this fast-path isn't just used by spreads anymore. Bug: chromium:707675 Change-Id: I8045d83977735dd00c3ebde2e0704f6b04afdedd Reviewed-on: https://chromium-review.googlesource.com/472907 Reviewed-by: Michael Starzinger <mstarzinger@chromium.org> Commit-Queue: Peter Marshall <petermarshall@chromium.org> Cr-Commit-Position: refs/heads/master@{#44531}
9 lines
268 B
JavaScript
9 lines
268 B
JavaScript
// Copyright 2017 the V8 project authors. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style license that can be
|
|
// found in the LICENSE file.
|
|
|
|
// Flags: --enable-slow-asserts
|
|
|
|
Array.prototype.__proto__ = null;
|
|
new Uint8Array(Array.prototype);
|