v8/test/mjsunit/regress-crbug-1359991.js
Marja Hölttä 23719f1afb [rab/gsab] TypedArray.p.slice fix: Destination can be resizable
Bug: v8:11111,chromium:1359991
Fixed: chromium:1359991
Change-Id: Ie150040d2831559eebb646772d9b2c494aadda98
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3874930
Reviewed-by: Shu-yu Guo <syg@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83012}
2022-09-07 06:41:26 +00:00

21 lines
496 B
JavaScript

// Copyright 2022 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --harmony-rab-gsab
"use strict";
const rab = new ArrayBuffer(1744, {"maxByteLength": 4000});
let callSlice = true;
class MyFloat64Array extends Float64Array {
constructor() {
super(rab);
if (callSlice) {
callSlice = false; // Prevent recursion
super.slice()
}
}
};
new MyFloat64Array();