22 lines
471 B
JavaScript
22 lines
471 B
JavaScript
|
// Copyright 2014 the V8 project authors. All rights reserved.
|
||
|
|
// Use of this source code is governed by a BSD-style license that can be
|
||
|
|
// found in the LICENSE file.
|
||
|
|
|
||
|
|
// Flags: --allow-natives-syntax
|
||
|
|
|
||
|
|
var a = ["string"];
|
||
|
|
function funky(array) { return array[0] = 1; }
|
||
|
|
funky(a);
|
||
|
|
|
||
|
|
function crash() {
|
||
|
|
var q = [0];
|
||
|
|
// The failing ASSERT was only triggered when compiling for OSR.
|
||
|
|
for (var i = 0; i < 100000; i++) {
|
||
|
|
funky(q);
|
||
|
|
}
|
||
|
|
q[0] = 0;
|
||
|
|
funky(q)
|
||
|
|
}
|
||
|
|
|
||
|
|
crash();
|