// Copyright 2017 the V8 project authors. All rights reserved.// Use of this source code is governed by a BSD-style license that can be// found in the LICENSE file.// Flags: --verify-heapclassArray1extendsArray{constructor(len){super(1);}};classMyArrayextendsArray{staticget[Symbol.species](){returnArray1;}}a=newMyArray();for(vari=0;i<100000;i++){a.push(1);}a.map(function(x){return42;});