diff options
Diffstat (limited to 'deps/v8/test/mjsunit/regress/regress-897512.js')
-rw-r--r-- | deps/v8/test/mjsunit/regress/regress-897512.js | 24 |
1 files changed, 24 insertions, 0 deletions
diff --git a/deps/v8/test/mjsunit/regress/regress-897512.js b/deps/v8/test/mjsunit/regress/regress-897512.js new file mode 100644 index 0000000000..0e676a06c2 --- /dev/null +++ b/deps/v8/test/mjsunit/regress/regress-897512.js @@ -0,0 +1,24 @@ +// Copyright 2018 the V8 project authors. All rights reserved. +// Use of this source code is governed by a BSD-style license that can be +// found in the LICENSE file. + +// Fill up the Array prototype's elements. +for (let i = 0; i < 100; i++) Array.prototype.unshift(3.14); + +// Create a holey double elements array. +const o31 = [1.1]; +o31[37] = 2.2; + +// Concat converts to dictionary elements. +const o51 = o31.concat(false); + +// Set one element to undefined to trigger the movement bug. +o51[0] = undefined; + +assertEquals(o51.length, 39); + +// Sort triggers the bug. +o51.sort(); + +// TODO(chromium:897512): The length should be 39. +assertEquals(o51.length, 101); |