v8/test/mjsunit/regress/regress-crbug-1392577.js
Marja Hölttä 993d2ea282 [rab/gsab] Fix length reloading in TA.p.fill
Bug: v8:11111,chromium:1392577
Change-Id: I28c0559fdccdc97eefedbbcbffeefa895cddb9c4
Fixed: chromium:1392577
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4047206
Commit-Queue: Marja Hölttä <marja@chromium.org>
Auto-Submit: Marja Hölttä <marja@chromium.org>
Reviewed-by: Shu-yu Guo <syg@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84428}
2022-11-23 08:32:27 +00:00

15 lines
383 B
JavaScript

// Copyright 2022 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --harmony-rab-gsab
const rab = new ArrayBuffer(50, {"maxByteLength": 100});
const ta = new Int8Array(rab);
const start = {};
start.valueOf = function() {
rab.resize(0);
return 5;
}
ta.fill(5, start);