| // Copyright 2018 the V8 project authors. All rights reserved. |
| // Use of this source code is governed by a BSD-style license that can be |
| // found in the LICENSE file. |
| |
| // Flags: --allow-natives-syntax |
| |
| let arr = new Array(0x10000); |
| let resolve_element_closures = new Array(0x10000); |
| |
| for (let i = 0; i < arr.length; i++) { |
| arr[i] = new Promise(() => {}); |
| arr[i].then = ((idx, resolve) => { |
| resolve_element_closures[idx] = resolve; |
| }).bind(null, i); |
| } |
| |
| Promise.all(arr); |
| |
| // 0xffff is too large, transitions to DICTIONARY_ELEMENTS |
| resolve_element_closures[0xffff](); |
| |
| // grows the capacity, the elements kind of the result array is still DICTIONARY_ELEMENTS, but the elements object of it is no more a dictionary. |
| resolve_element_closures[100](); |
| |
| // You can observe that V8 crashes here in debug mode. |
| resolve_element_closures[0xfffe](); |
