e3aec7a587
R=ulan@chromium.org TEST=mjsunit/regress/regress-builtinbust-3 Review URL: https://codereview.chromium.org/230453002 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20602 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
16 lines
547 B
JavaScript
16 lines
547 B
JavaScript
// Copyright 2014 the V8 project authors. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style license that can be
|
|
// found in the LICENSE file.
|
|
|
|
function produce_object() {
|
|
var real_length = 1;
|
|
function set_length() { real_length = "boom"; }
|
|
function get_length() { return real_length; }
|
|
var o = { __proto__:Array.prototype , 0:"x" };
|
|
Object.defineProperty(o, "length", { set:set_length, get:get_length })
|
|
return o;
|
|
}
|
|
|
|
assertEquals(2, produce_object().push("y"));
|
|
assertEquals(2, produce_object().unshift("y"));
|