v8/test/mjsunit/regress/regress-crbug-1381064.js
Marja Hölttä 28545f7aea [rab/gsab] Fix toPrimitive resizing the backing store
Bug: v8:11111,chromium:1381064
Change-Id: Id4f5f56758f0ec7999fe523a0849dd26d84ecc47
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4002208
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Reviewed-by: Shu-yu Guo <syg@chromium.org>
Auto-Submit: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84054}
2022-11-03 23:30:36 +00:00

20 lines
649 B
JavaScript

// Copyright 2022 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --harmony-rab-gsab
(function NonBigIntRegressionTest() {
const rab = new ArrayBuffer(1050, {"maxByteLength": 2000});
const ta = new Uint8ClampedArray(rab);
ta[Symbol.toPrimitive] = () => { rab.resize(0); return 0; };
ta[916] = ta;
})();
(function BigIntRegressionTest() {
const rab = new ArrayBuffer(8 * 100, {"maxByteLength": 8 * 200});
const ta = new BigInt64Array(rab);
ta[Symbol.toPrimitive] = () => { rab.resize(0); return 0n; };
ta[1] = ta;
})();