v8/test/mjsunit/regress/regress-crbug-1360736.js
Marja Hölttä 62635a7270 [rab/gsab] Fix leftover IsTypedArrayElementsKind checks in map transitions
With everything related to map transitions, RAB/GSAB typed array
elements kinds should behave exactly like non-RAB/GSAB typed array
elements kinds.

Bug: chromium:1360736, v8:11111
Change-Id: Ie5cef928a25856f0c476653275066b49dfee6e41
Fixed: chromium:1360736
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3879497
Reviewed-by: Shu-yu Guo <syg@chromium.org>
Auto-Submit: Marja Hölttä <marja@chromium.org>
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83119}
2022-09-09 23:55:45 +00:00

10 lines
349 B
JavaScript

// Copyright 2022 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
const rab = new ArrayBuffer(ArrayBuffer, {"maxByteLength": 7158170});
const ta = new Uint8Array(rab);
const proxy = new Proxy(ta, {});
proxy.valueOf = () => {};
Object.seal(proxy);