v8/test/mjsunit/es7/regress
adamk 1f1329d960 Use SetOwnElement when creating splice records in array length setter
This avoids touching the Array prototype, which may have been tampered with.

BUG=chromium:443982
LOG=n

Review URL: https://codereview.chromium.org/820503005

Cr-Commit-Position: refs/heads/master@{#25908}
2014-12-19 19:39:35 +00:00
..
regress-443982.js Use SetOwnElement when creating splice records in array length setter 2014-12-19 19:39:35 +00:00