OLD | NEW |
(Empty) | |
| 1 // Copyright 2016 the V8 project authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. |
| 4 |
| 5 // Flags: --expose-gc |
| 6 |
| 7 array = new Array(10); |
| 8 array[0] = 0.1; |
| 9 // array[1] = THE_HOLE, reading through the prototype chain |
| 10 array[2] = 2.1; |
| 11 array[3] = 3.1; |
| 12 |
| 13 var copy = array.slice(0, array.length); |
| 14 |
| 15 // Use the defaul array prototype. |
| 16 var proto = array.__proto__; |
| 17 |
| 18 // Define [1] on the prototype to alter the array during concatenation. |
| 19 Object.defineProperty( |
| 20 proto, 1, { |
| 21 get() { |
| 22 // Alter the array. |
| 23 array.length = 1; |
| 24 // Force gc to move the array. |
| 25 gc(); |
| 26 return "value from proto"; |
| 27 }, |
| 28 set(new_value) { } |
| 29 }); |
| 30 |
| 31 var concatted_array = Array.prototype.concat.call(array); |
| 32 assertEquals(concatted_array[0], 0.1); |
| 33 assertEquals(concatted_array[1], "value from proto"); |
| 34 assertEquals(concatted_array[2], undefined); |
| 35 assertEquals(concatted_array[3], undefined); |
OLD | NEW |