-
jameslahm authored
... when setting the prototype of TypedArray constructor. Setting the __proto__ of TypedArray constructor could change TypedArray's @@species, thus we need to invalidate the @@species protector. Bug: v8:13110 Change-Id: Ib3b2c88d1136965c221492ff81a26ae69533b356 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3813063 Commit-Queue: 王澳 <wangao.james@bytedance.com> Reviewed-by: Marja Hölttä <marja@chromium.org> Reviewed-by: Jakob Linke <jgruber@chromium.org> Cr-Commit-Position: refs/heads/main@{#82282}
15aa8c58