v8/test/mjsunit/regress/get-array-keys-oob.js
verwaest c6f9883d53 Remove oob elements collected from the prototype chain by trimming in GetArrayKeys
BUG=chromium:594953
LOG=n

Review URL: https://codereview.chromium.org/1817443003

Cr-Commit-Position: refs/heads/master@{#34893}
2016-03-18 14:37:36 +00:00

7 lines
219 B
JavaScript

// Copyright 2016 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
Array.prototype[10000000] = 1;
Array(1000).join();