From 5c2d555b29d99f9d1f484fd46eff33b42ee9c11f Mon Sep 17 00:00:00 2001 From: Michaël Zasso Date: Sat, 3 Nov 2018 13:20:30 +0100 Subject: deps: patch V8 to 7.0.276.35 Refs: https://github.com/v8/v8/compare/7.0.276.32...7.0.276.35 PR-URL: https://github.com/nodejs/node/pull/24056 Reviewed-By: Colin Ihrig Reviewed-By: Refael Ackermann --- deps/v8/test/mjsunit/regress/regress-897512.js | 24 ++++++++++++++++++++++++ 1 file changed, 24 insertions(+) create mode 100644 deps/v8/test/mjsunit/regress/regress-897512.js (limited to 'deps/v8/test') diff --git a/deps/v8/test/mjsunit/regress/regress-897512.js b/deps/v8/test/mjsunit/regress/regress-897512.js new file mode 100644 index 0000000000..0e676a06c2 --- /dev/null +++ b/deps/v8/test/mjsunit/regress/regress-897512.js @@ -0,0 +1,24 @@ +// Copyright 2018 the V8 project authors. All rights reserved. +// Use of this source code is governed by a BSD-style license that can be +// found in the LICENSE file. + +// Fill up the Array prototype's elements. +for (let i = 0; i < 100; i++) Array.prototype.unshift(3.14); + +// Create a holey double elements array. +const o31 = [1.1]; +o31[37] = 2.2; + +// Concat converts to dictionary elements. +const o51 = o31.concat(false); + +// Set one element to undefined to trigger the movement bug. +o51[0] = undefined; + +assertEquals(o51.length, 39); + +// Sort triggers the bug. +o51.sort(); + +// TODO(chromium:897512): The length should be 39. +assertEquals(o51.length, 101); -- cgit v1.2.3