v8/test/mjsunit/regress/regress-854066-2.js
Peter Marshall bededee46e [typedarray] Use slow case more aggressively in CopyElementsHandleImpl
Change-Id: If133fe47a086ed273446ee7e8f8af85bf9fc8389
Reviewed-on: https://chromium-review.googlesource.com/1108203
Commit-Queue: Peter Marshall <petermarshall@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53921}
2018-06-21 12:14:18 +00:00

15 lines
430 B
JavaScript

// Copyright 2018 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
oobArray = [];
delete oobArray.__proto__[Symbol.iterator];
for (let i = 0; i < 1e5; ++i) {
oobArray[i] = 1.1;
}
floatArray = new Float64Array(oobArray.length);
Float64Array.from.call(function(length) {
oobArray.length = 0;
return floatArray;
}, oobArray);