| // Copyright 2017 the V8 project authors. All rights reserved. | |
| // Use of this source code is governed by a BSD-style license that can be | |
| // found in the LICENSE file. | |
| var array = []; | |
| var proxy = new Proxy(new Proxy(array, {}), {}); | |
| var Ctor = function() {}; | |
| var result; | |
| array.constructor = function() {}; | |
| array.constructor[Symbol.species] = Ctor; | |
| Array.prototype.slice.call(proxy); |