d31a5b6569
Whenever left-trimming is possible (e.g. whenever user code is called), we must not store a reference to an exposed JSArray's elements. Bug: chromium:897366,v8:7382 Change-Id: I8dd6a93aa6ed19e755ccce7122e0e019dc578a31 Reviewed-on: https://chromium-review.googlesource.com/c/1292066 Reviewed-by: Camillo Bruni <cbruni@chromium.org> Commit-Queue: Jakob Gruber <jgruber@chromium.org> Cr-Commit-Position: refs/heads/master@{#56903}
16 lines
336 B
JavaScript
16 lines
336 B
JavaScript
// Copyright 2018 the V8 project authors. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style license that can be
|
|
// found in the LICENSE file.
|
|
|
|
// Flags: --gc-interval=100
|
|
|
|
let xs = [];
|
|
for (let i = 0; i < 205; ++i) {
|
|
xs.push(i);
|
|
}
|
|
xs.sort((a, b) => {
|
|
xs.shift();
|
|
xs[xs.length] = -246;
|
|
return a - b;
|
|
});
|