192984ea88
More care must be taken to remain on the fast path in the face of @@species constructors. BUG=chromium:716044 Review-Url: https://codereview.chromium.org/2846963003 Cr-Commit-Position: refs/heads/master@{#45065}
26 lines
469 B
JavaScript
26 lines
469 B
JavaScript
// Copyright 2017 the V8 project authors. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style license that can be
|
|
// found in the LICENSE file.
|
|
|
|
// Flags: --verify-heap
|
|
|
|
class Array1 extends Array {
|
|
constructor(len) {
|
|
super(1);
|
|
}
|
|
};
|
|
|
|
class MyArray extends Array {
|
|
static get [Symbol.species]() {
|
|
return Array1;
|
|
}
|
|
}
|
|
|
|
a = new MyArray();
|
|
|
|
for (var i = 0; i < 100000; i++) {
|
|
a.push(1);
|
|
}
|
|
|
|
a.map(function(x) { return 42; });
|