1 2 3 4 5 6 7 8 9
verifyprebarriers() x = [] function z() {} Object.defineProperty(x, 2, { value: z }) gczeal(2, 2) y = x.slice(2) y.e = (function() {})