Ben Murdoch | 097c5b2 | 2016-05-18 11:27:45 +0100 | [diff] [blame] | 1 | // Copyright 2016 the V8 project authors. All rights reserved. |
| 2 | // Use of this source code is governed by a BSD-style license that can be |
| 3 | // found in the LICENSE file. |
| 4 | |
| 5 | // Flags: --expose-gc |
| 6 | |
| 7 | array = new Array(10); |
| 8 | array[0] = 0.1; |
| 9 | // array[1] = THE_HOLE, reading through the prototype chain |
| 10 | array[2] = 2.1; |
| 11 | array[3] = 3.1; |
| 12 | |
| 13 | var copy = array.slice(0, array.length); |
| 14 | |
| 15 | // Change the array's prototype. |
| 16 | var proto = {}; |
| 17 | array.__proto__ = proto; |
| 18 | |
| 19 | // Define [1] on the prototype to alter the array during concatenation. |
| 20 | Object.defineProperty( |
| 21 | proto, 1, { |
| 22 | get() { |
| 23 | // Alter the array. |
| 24 | array.length = 1; |
| 25 | // Force gc to move the array. |
| 26 | gc(); |
| 27 | return "value from proto"; |
| 28 | }, |
| 29 | set(new_value) { } |
| 30 | }); |
| 31 | |
| 32 | var concatted_array = Array.prototype.concat.call(array); |
| 33 | assertEquals(concatted_array[0], 0.1); |
| 34 | assertEquals(concatted_array[1], "value from proto"); |
| 35 | assertEquals(concatted_array[2], undefined); |
| 36 | assertEquals(concatted_array[3], undefined); |