631629ad54
The IterableToList helper builtin can return the input JSArray unchanged if the fast-path detection decides that it doesn't need to iterate the elements, which means we can also get a JSArray with an elements kind that is not PACKED_ELEMENTS as a result of IterableToList. Bug: chromium:821159, v8:7310 Change-Id: I93a886e6b7f1e1a58dd05affa46fea7501cc5a81 Reviewed-on: https://chromium-review.googlesource.com/959323 Reviewed-by: Yang Guo <yangguo@chromium.org> Commit-Queue: Benedikt Meurer <bmeurer@chromium.org> Cr-Commit-Position: refs/heads/master@{#51893}
9 lines
244 B
JavaScript
9 lines
244 B
JavaScript
// Copyright 2018 the V8 project authors. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style license that can be
|
|
// found in the LICENSE file.
|
|
|
|
// Flags: --allow-natives-syntax
|
|
|
|
Array.prototype[0] = 0;
|
|
Math.max(...[3]);
|