node/deps/v8/test/mjsunit/regress/regress-crbug-387031.js
Trevor Norris f9ce97084c v8: Upgrade 3.26.33 with 14 patches
V8 3.26.31 has received 14 patches since the upgrade to 3.26.33. Since
3.26.33 is technically a tag on the 3.27 branch, reverting back to
3.26.31 would remove now default functionality like WeakMaps. Because of
that the patches have simply been cherry-picked and squashed.

Here is a summary of all patches:

* Fix index register assignment in LoadFieldByIndex for arm, arm64, and
  mips.
* Fix invalid attributes when generalizing because of incompatible map
  change.
* Skip write barriers when updating the weak hash table.
* MIPS: Avoid HeapObject check in HStoreNamedField.
* Do GC if CodeRange fails to allocate a block.
* Array.concat: properly go to dictionary mode when required.
* Keep CodeRange::current_allocation_block_index_ in range.
* Grow heap slower if GC freed many global handles.
* Do not eliminate bounds checks for "<const> - x".
* Add missing map check to optimized f.apply(...).
* In GrowMode, force the value to the right representation to avoid
  deopts between storing the length and storing the value.
* Reduce max executable size limit.
* Fix invalid condition in check elimination effects.
* Fix off-by-one error in Array.concat slow mode check.

For more information see: https://github.com/v8/v8/commits/3.26

Reviewed-By: Fedor Indutny <fedor@indutny.com>
2014-09-09 16:52:10 -07:00

16 lines
369 B
JavaScript

// Copyright 2014 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --allow-natives-syntax
a = [1];
b = [];
a.__defineGetter__(0, function () {
b.length = 0xffffffff;
});
c = a.concat(b);
for (var i = 0; i < 20; i++) {
assertEquals(undefined, (c[i]));
}