1 files changed, 35 insertions, 0 deletions
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-776511.js b/deps/v8/test/mjsunit/regress/regress-crbug-776511.js
new file mode 100644
index 0000000000..f757bc2cc2
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-776511.js
@@ -0,0 +1,35 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --enable-slow-asserts --expose-gc --allow-natives-syntax
+
+function __getProperties(obj) {
+  let properties = [];
+  for (let name of Object.getOwnPropertyNames(obj)) {
+    properties.push(name);
+  }
+  return properties;
+}
+function __getRandomProperty(obj, seed) {
+  let properties = __getProperties(obj);
+  return properties[seed % properties.length];
+}
+(function() {
+  var __v_59904 = [12, 13, 14, 16, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25];
+  var __v_59906 = function(__v_59908) {
+    var __v_59909 = function(__v_59910, __v_59911) {
+      if (__v_59911 == 13 && __v_59908) {
+        __v_59904.abc = 25;
+      }
+      return true;
+    };
+    return __v_59904.filter(__v_59909);
+  };
+  print(__v_59906());
+  __v_59904[__getRandomProperty(__v_59904, 366855)] = this, gc();
+  print(__v_59906());
+  %OptimizeFunctionOnNextCall(__v_59906);
+  var __v_59907 = __v_59906(true);
+  print(__v_59907);
+})();