mirror of
				https://github.com/tc39/test262.git
				synced 2025-10-31 19:53:50 +01:00 
			
		
		
		
	sourceRevisionAtLastExport: 33f2fb0e53d135f0ee17cfccd9d993eb2a6f47de targetRevisionAtLastExport: 31340cbd9add103f586d501b0c3354b7b182abc0
		
			
				
	
	
		
			26 lines
		
	
	
		
			538 B
		
	
	
	
		
			JavaScript
		
	
	
	
	
	
			
		
		
	
	
			26 lines
		
	
	
		
			538 B
		
	
	
	
		
			JavaScript
		
	
	
	
	
	
| // Copyright 2017 the V8 project authors. All rights reserved.
 | |
| // Use of this source code is governed by a BSD-style license that can be
 | |
| // found in the LICENSE file.
 | |
| 
 | |
| // Flags: --expose-gc --enable-slow-asserts
 | |
| 
 | |
| a = new Proxy([], {
 | |
|   defineProperty() {
 | |
|     b.length = 1; gc();
 | |
|     return Object.defineProperty.apply(this, arguments);
 | |
|   }
 | |
| });
 | |
| 
 | |
| class MyArray extends Array {
 | |
|   static get[Symbol.species](){
 | |
|     return function() {
 | |
|       return a;
 | |
|     }
 | |
|   };
 | |
| }
 | |
| 
 | |
| b = new MyArray(65535);
 | |
| b[1] = 0.1;
 | |
| c = Array.prototype.concat.call(b);
 | |
| gc();
 |