Source code
Revision control
Copy as Markdown
Other Tools
const buffer = new ArrayBuffer(0x100000000);
const proto = new Uint8Array(buffer);
function store(obj) { obj["4294967295"] = 1; }
for (let i = 0; i < 200; i++) store(Object.create(proto));
buffer.transfer(0);
const obj = Object.create(proto);
store(obj);
if (Object.hasOwn(obj, "4294967295"))
throw new Error("JIT added a property through a detached typed-array prototype");