// Copyright 2018 the V8 project authors. All rights reserved.// Use of this source code is governed by a BSD-style license that can be// found in the LICENSE file.// Tests that creating an iterator that shrinks the array populated by// Array.from does not lead to out of bounds writes.letoobArray=[];letmaxSize=1028*8;Array.from.call(function(){returnoobArray},{[Symbol.iterator]:_=>({counter:0,next(){letresult=this.counter++;if(this.counter>maxSize){oobArray.length=0;return{done:true};}else{return{value:result,done:false};}}})});assertEquals(oobArray.length,maxSize);// iterator reset the length to 0 just before returning done, so this will crash// if the backing store was not resized correctly.oobArray[oobArray.length-1]=0x41414141;