text: // Copyright 2018 the V8 project authors. All rights reserved.
  // Use of this source code is governed by a BSD-style license that can be
  // found in the LICENSE file.
  
  // Tests that creating an iterator that shrinks the array populated by
  // Array.from does not lead to out of bounds writes.
  let oobArray = [];
  let maxSize = 1028 * 8;
  Array.from.call(function() { return oobArray }, {[Symbol.iterator] : _ => (
    {
      counter : 0,
      next() {
        let result = this.counter++;
        if (this.counter > maxSize) {
          oobArray.length = 0;
          return {done: true};
        } else {
          return {value: result, done: false};
        }
      }
    }
  ) });
  assertEquals(oobArray.length, maxSize);
  
  // iterator reset the length to 0 just before returning done, so this will crash
  // if the backing store was not resized correctly.
  oobArray[oobArray.length - 1] = 0x41414141;
  