1 files changed, 42 insertions, 0 deletions
diff --git a/deps/v8/test/mjsunit/keyed-load-null-receiver.js b/deps/v8/test/mjsunit/keyed-load-null-receiver.js
new file mode 100644
index 0000000000..b5b844b171
--- /dev/null
+++ b/deps/v8/test/mjsunit/keyed-load-null-receiver.js
@@ -0,0 +1,42 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var count = 0;
+function load(a) {
+  var prop = {
+    toString: function() {
+      count++;
+      return 'z';
+    }
+  };
+
+  a[prop] ^= 1;
+}
+
+function f(null_or_undefined) {
+  // Turn the LoadIC megamorphic
+  load({a0:1, z:2});
+  load({a1:1, z:2});
+  load({a2:1, z:2});
+  load({a3:1, z:2});
+  load({a4:1, z:2});
+  // Now try null to check if generic IC handles this correctly.
+  // It shouldn't call prop.toString.
+  load(null_or_undefined);
+}
+
+try {
+  f(null);
+} catch(error) {
+  assertInstanceof(error, TypeError);
+  assertSame(10, count);
+}
+
+try {
+  count = 0;
+  f(undefined);
+} catch(error) {
+  assertInstanceof(error, TypeError);
+  assertSame(10, count);
+}