diff options
Diffstat (limited to 'deps/v8/test/mjsunit/regress/regress-8449.js')
-rw-r--r-- | deps/v8/test/mjsunit/regress/regress-8449.js | 25 |
1 files changed, 25 insertions, 0 deletions
diff --git a/deps/v8/test/mjsunit/regress/regress-8449.js b/deps/v8/test/mjsunit/regress/regress-8449.js new file mode 100644 index 0000000000..32fa82aa6e --- /dev/null +++ b/deps/v8/test/mjsunit/regress/regress-8449.js @@ -0,0 +1,25 @@ +// Copyright 2018 the V8 project authors. All rights reserved. +// Use of this source code is governed by a BSD-style license that can be +// found in the LICENSE file. + +{ + const x = [, 1]; + x.__proto__ = [42]; + const y = [...x]; + assertEquals([42, 1], y); + assertTrue(y.hasOwnProperty(0)); +} + +{ + const x = [, 1]; + x.__proto__ = [42]; + assertEquals(42, x[Symbol.iterator]().next().value); +} + +{ + const array_prototype = [].__proto__; + array_prototype[0] = 42; + const x = [, 1]; + assertEquals(42, x[Symbol.iterator]().next().value); + delete array_prototype[0]; +} |