third_party/v8/test/mjsunit/regress/regress-crbug-1057653.js - cobalt - Git at Google

 // Copyright 2020 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.

 Object.prototype.length = 3642395160;
 const array = new Float32Array(2**27);

 assertThrows(() => {for (const key in array) {}}, RangeError);
	// Copyright 2020 the V8 project authors. All rights reserved.
	// Use of this source code is governed by a BSD-style license that can be
	// found in the LICENSE file.

	Object.prototype.length = 3642395160;
	const array = new Float32Array(2**27);

	assertThrows(() => {for (const key in array) {}}, RangeError);