v8/test/mjsunit/regress/regress-crbug-823069.js
Igor Sheludko 75e04cd22c [builtins] Throw on pop()/shift() when JSArray's length is not writable.
Bug: chromium:823069
Change-Id: Ie5be40da1e64a11c7a3c6ba5d2bc193bd78ca737
Reviewed-on: https://chromium-review.googlesource.com/1002560
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52508}
2018-04-10 08:51:07 +00:00

9 lines
307 B
JavaScript

// Copyright 2018 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
var v = [];
Object.defineProperty(v, "length", {value: 3, writable: false});
assertThrows(()=>{v.pop();});
assertThrows(()=>{v.shift();});