1 files changed, 32 insertions, 0 deletions
diff --git a/deps/v8/test/mjsunit/compiler/regress-1071743.js b/deps/v8/test/mjsunit/compiler/regress-1071743.js
new file mode 100644
index 00000000000..f2d1d07a9d1
--- /dev/null
+++ b/deps/v8/test/mjsunit/compiler/regress-1071743.js
@@ -0,0 +1,32 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+
+function foo(v) {
+  let x = Math.floor(v);
+  Number.prototype[v] = 42;
+  return x + Math.floor(v);
+}
+
+%PrepareFunctionForOptimization(foo);
+assertSame(foo(-0), -0);
+assertSame(foo(-0), -0);
+%OptimizeFunctionOnNextCall(foo);
+assertSame(foo(-0), -0);
+
+
+function bar(v) {
+  v = v ? (v|0) : -0;  // v has now type Integral32OrMinusZero.
+  let x = Math.floor(v);
+  Number.prototype[v] = 42;
+  return x + Math.floor(v);
+}
+
+%PrepareFunctionForOptimization(bar);
+assertSame(2, bar(1));
+assertSame(2, bar(1));
+%OptimizeFunctionOnNextCall(bar);
+assertSame(-0, bar(-0));