mirror of
https://github.com/tc39/test262.git
synced 2025-10-31 11:44:31 +01:00
7298a38552
sourceRevisionAtLastExport: 33f2fb0e53d135f0ee17cfccd9d993eb2a6f47de targetRevisionAtLastExport: 31340cbd9add103f586d501b0c3354b7b182abc0
22 lines
629 B
JavaScript
22 lines
629 B
JavaScript
// Copyright 2018 the V8 project authors. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style license that can be
|
|
// found in the LICENSE file.
|
|
|
|
// a has packed SMI elements
|
|
a = [];
|
|
|
|
// a has dictionary elements
|
|
a.length = 0xFFFFFFF;
|
|
|
|
// a has dictionary elements and the backing array is
|
|
// empty_slow_element_dictionary (length 0)
|
|
a.length = 0;
|
|
|
|
// a has dictionary elements and the backing array is
|
|
// empty_slow_element_dictionary (length 0xFFFFFFF)
|
|
a.length = 0xFFFFFFF;
|
|
|
|
// This will crash if V8 attempts to remove 0 elements from
|
|
// empty_slow_element_dictionary as it is in RO_SPACE.
|
|
a.length = 1;
|