diff options
Diffstat (limited to 'deps/v8/test/mjsunit/regress/regress-crbug-902672.js')
| -rw-r--r-- | deps/v8/test/mjsunit/regress/regress-crbug-902672.js | 8 |
1 files changed, 8 insertions, 0 deletions
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-902672.js b/deps/v8/test/mjsunit/regress/regress-crbug-902672.js new file mode 100644 index 0000000000..4073b554e9 --- /dev/null +++ b/deps/v8/test/mjsunit/regress/regress-crbug-902672.js @@ -0,0 +1,8 @@ +// Copyright 2018 the V8 project authors. All rights reserved. +// Use of this source code is governed by a BSD-style license that can be +// found in the LICENSE file. + +var a = this; +var b = {}; +a.length = 4294967296; // 2 ^ 32 (max array length + 1) +assertThrows(() => Array.prototype.join.call(a,b), TypeError); |