nodejs/deps/v8/test/mjsunit/regress/regress-crbug-1426357.js
Michaël Zasso 17a74ddd3d
deps: update V8 to 11.8.172.13
PR-URL: https://github.com/nodejs/node/pull/49639
Reviewed-By: Jiawen Geng <technicalcute@gmail.com>
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
2023-10-10 08:25:41 +02:00

20 lines
592 B
JavaScript

// Copyright 2023 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Fast array fill should be robust against evil object coercions.
(function TestStart() {
let arr = [1,2,3,4];
arr.fill(42, { toString() { arr.length = 0; } });
assertEquals(4, arr.length);
assertEquals([42,42,42,42], arr);
})();
(function TestEnd() {
let arr = [1,2,3,4];
arr.fill(42, 0, { toString() { arr.length = 0; return 4; } });
assertEquals(4, arr.length);
assertEquals([42,42,42,42], arr);
})();