v8/test/mjsunit/regress/regress-707410.js
Peter Marshall 645efbfd1e [typedarrays] Throw on construction of a detached typed array.
Bug: chromium:840106
Cq-Include-Trybots: luci.v8.try:v8_linux_noi18n_rel_ng
Change-Id: I0090cdecaf9194f3ed2d716c6f5f698e33cbdf0d
Reviewed-on: https://chromium-review.googlesource.com/1046827
Commit-Queue: Peter Marshall <petermarshall@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53029}
2018-05-07 15:30:48 +00:00

10 lines
306 B
JavaScript

// Copyright 2017 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --allow-natives-syntax
var a = new Uint8Array(1024*1024);
%ArrayBufferNeuter(a.buffer);
assertThrows(() => new Uint8Array(a));