1 // Copyright 2016 the V8 project authors. All rights reserved. 2 // Use of this source code is governed by a BSD-style license that can be 3 // found in the LICENSE file. 4 5 // Flags: --expose-gc 6 7 array = new Array(10); 8 array[0] = 0.1; 9 // array[1] = THE_HOLE, reading through the prototype chain 10 array[2] = 2.1; 11 array[3] = 3.1; 12 13 var copy = array.slice(0, array.length); 14 15 // Change the array's prototype. 16 var proto = {}; 17 array.__proto__ = proto; 18 19 // Define [1] on the prototype to alter the array during concatenation. 20 Object.defineProperty( 21 proto, 1, { 22 get() { 23 // Alter the array. 24 array.length = 1; 25 // Force gc to move the array. 26 gc(); 27 return "value from proto"; 28 }, 29 set(new_value) { } 30 }); 31 32 var concatted_array = Array.prototype.concat.call(array); 33 assertEquals(concatted_array[0], 0.1); 34 assertEquals(concatted_array[1], "value from proto"); 35 assertEquals(concatted_array[2], undefined); 36 assertEquals(concatted_array[3], undefined); 37
