1 files changed, 33 insertions, 0 deletions
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-899524.js b/deps/v8/test/mjsunit/regress/regress-crbug-899524.js
new file mode 100644
index 0000000000..32d28c9b09
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-899524.js
@@ -0,0 +1,33 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function empty() { }
+
+function baz(expected, found) {
+  var start = "";
+  found.length, start + 'x';
+  if (expected.length === found.length) {
+    for (var i = 0; i < expected.length; ++i) {
+      empty(found[i]);
+    }
+  }
+}
+
+baz([1], new (class A extends Array {}));
+
+(function () {
+  "use strict";
+  function bar() {
+    baz([1,2], arguments);
+  }
+  function foo() {
+    bar(2147483648,-[]);
+  }
+  foo();
+  foo();
+  %OptimizeFunctionOnNextCall(foo);
+  foo();
+})();