diff options
Diffstat (limited to 'deps/v8/test/mjsunit/regress/regress-4964.js')
-rw-r--r-- | deps/v8/test/mjsunit/regress/regress-4964.js | 22 |
1 files changed, 22 insertions, 0 deletions
diff --git a/deps/v8/test/mjsunit/regress/regress-4964.js b/deps/v8/test/mjsunit/regress/regress-4964.js new file mode 100644 index 0000000000..d834708667 --- /dev/null +++ b/deps/v8/test/mjsunit/regress/regress-4964.js @@ -0,0 +1,22 @@ +// Copyright 2016 the V8 project authors. All rights reserved. +// Use of this source code is governed by a BSD-style license that can be +// found in the LICENSE file. + +// Flags: --allow-natives-syntax + +// Neutered source +var ab = new ArrayBuffer(10); +ab.constructor = { get [Symbol.species]() { %ArrayBufferNeuter(ab); return ArrayBuffer; } }; +assertThrows(() => ab.slice(0), TypeError); + +// Neutered target +class NeuteredArrayBuffer extends ArrayBuffer { + constructor(...args) { + super(...args); + %ArrayBufferNeuter(this); + } +} + +var ab2 = new ArrayBuffer(10); +ab2.constructor = NeuteredArrayBuffer; +assertThrows(() => ab2.slice(0), TypeError); |