diff options
Diffstat (limited to 'deps/v8/test/mjsunit/regress/regress-crbug-865312.js')
-rw-r--r-- | deps/v8/test/mjsunit/regress/regress-crbug-865312.js | 34 |
1 files changed, 34 insertions, 0 deletions
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-865312.js b/deps/v8/test/mjsunit/regress/regress-crbug-865312.js new file mode 100644 index 00000000000..8df1bd92d2b --- /dev/null +++ b/deps/v8/test/mjsunit/regress/regress-crbug-865312.js @@ -0,0 +1,34 @@ +// Copyright 2018 the V8 project authors. All rights reserved. +// Use of this source code is governed by a BSD-style license that can be +// found in the LICENSE file. + +const intArrayConstructors = [ + Uint8Array, + Int8Array, + Uint16Array, + Int16Array, + Uint32Array, + Int32Array, + Uint8ClampedArray +]; + +const floatArrayConstructors = [ + Float32Array, + Float64Array +]; + +const typedArrayConstructors = [...intArrayConstructors, + ...floatArrayConstructors]; + +for (let constructor of typedArrayConstructors) { + // Shadowing the length of a TypedArray should work for Array.p.fill, + // but not crash it. + let array = new constructor([2, 2]); + assertEquals(2, array.length); + + Object.defineProperty(array, 'length', {value: 5}); + Array.prototype.fill.call(array, 5); + + assertArrayEquals([5, 5], [array[0], array[1]]); + assertEquals(undefined, array[2]); +} |