| OLD | NEW |
| 1 // Copyright 2014 the V8 project authors. All rights reserved. | 1 // Copyright 2014 the V8 project authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 delete Object.prototype.__proto__; | 5 // Flags: --allow-natives-syntax --enable-slow-asserts |
| 6 | 6 |
| 7 function f() { | 7 function f() { |
| 8 this.toString = 1; | 8 var x = new Array(0); |
| 9 x[-1] = -1; |
| 10 Object.observe(x, function() { }); |
| 9 } | 11 } |
| 10 | 12 |
| 11 f.apply({}); | |
| 12 f(); | 13 f(); |
| 14 f(); |
| OLD | NEW |