9977a2caf3
Ensure that receiver->elements() == *dictionary after calling an accessor, in addition to checking the prototype. BUG=chromium:634273, chromium: 634357, v8:5162 R=cbruni@chromium.org, mstarzinger@chromium.org Review-Url: https://codereview.chromium.org/2212963002 Cr-Commit-Position: refs/heads/master@{#38347}
15 lines
413 B
JavaScript
15 lines
413 B
JavaScript
// Copyright 2016 the V8 project authors. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style license that can be
|
|
// found in the LICENSE file.
|
|
|
|
// Flags: --enable-slow-asserts
|
|
|
|
array = new Array(undefined, undefined, undefined);
|
|
Object.defineProperty(array, 0, {
|
|
get: function() {
|
|
array.push(undefined, undefined);
|
|
}
|
|
});
|
|
array[0x80000] = 1;
|
|
result = array.includes(new WeakMap());
|