v8/test/mjsunit/regress/regress-crbug-798644.js
Camillo Bruni be9c5fd982 [elements] Fix Object.entries/values with changing elements
Drive-by-cleanup:
- Add InternalElementsAccessor to expose protected instance methods
  to ElementsAccessor subclasses.
- Make some more ElementsAccessor methods protected that take the
  raw entry as parameter.

Bug: chromium:798644
Change-Id: Iffd00f1953461e8dd22c123e62298410fb6e049c
Reviewed-on: https://chromium-review.googlesource.com/856816
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50480}
2018-01-10 13:50:20 +00:00

22 lines
593 B
JavaScript

// Copyright 2018 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --allow-natives-syntax
let arr = [];
// Make the array large enough to trigger re-checking for compaction.
arr[1000] = 0x1234;
arr.__defineGetter__(256, function () {
// Remove the getter so we can compact the array.
delete arr[256];
// Trigger compaction.
arr.unshift(1.1);
});
let results = Object.entries(arr);
%HeapObjectVerify(results);
%HeapObjectVerify(arr);
let str = results.toString();