21389501f5
Bug: chromium:733059, chromium:724947 Change-Id: Id7abc22ee0975cd609cc06a02552f68e9e0077e8 Reviewed-on: https://chromium-review.googlesource.com/535596 Commit-Queue: Michael Lippautz <mlippautz@chromium.org> Reviewed-by: Ulan Degenbaev <ulan@chromium.org> Cr-Commit-Position: refs/heads/master@{#45952}
26 lines
538 B
JavaScript
26 lines
538 B
JavaScript
// Copyright 2017 the V8 project authors. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style license that can be
|
|
// found in the LICENSE file.
|
|
|
|
// Flags: --expose-gc --enable-slow-asserts
|
|
|
|
a = new Proxy([], {
|
|
defineProperty() {
|
|
b.length = 1; gc();
|
|
return Object.defineProperty.apply(this, arguments);
|
|
}
|
|
});
|
|
|
|
class MyArray extends Array {
|
|
static get[Symbol.species](){
|
|
return function() {
|
|
return a;
|
|
}
|
|
};
|
|
}
|
|
|
|
b = new MyArray(65535);
|
|
b[1] = 0.1;
|
|
c = Array.prototype.concat.call(b);
|
|
gc();
|