1 files changed, 16 insertions, 0 deletions
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-897404.js b/deps/v8/test/mjsunit/regress/regress-crbug-897404.js
new file mode 100644
index 0000000000..7e8b48de85
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-897404.js
@@ -0,0 +1,16 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function TestError() {}
+
+const a = new Array(2**32 - 1);
+
+// Force early exit to avoid an unreasonably long test.
+a[0] = {
+  toString() { throw new TestError(); }
+};
+
+// Verify join throws test error and does not fail due to asserts (Negative
+// length fixed array allocation).
+assertThrows(() => a.join(), TestError);