[array] Add regression test that causes left trimming while sorting
This CL adds a regression test that will check that the elements pointer is properly reloaded after the JavaScript comparison function is called during Array.p.sort. R=jgruber@chromium.org Bug: chromium:859809 Change-Id: I15f55fcc1906bd8d0751596e5457367a643b92da Reviewed-on: https://chromium-review.googlesource.com/1124475 Commit-Queue: Simon Zünd <szuend@google.com> Reviewed-by: Jakob Gruber <jgruber@chromium.org> Reviewed-by: Marja Hölttä <marja@chromium.org> Cr-Commit-Position: refs/heads/master@{#54174}
This commit is contained in:
parent
1e2617dcac
commit
26ac072990
21
test/mjsunit/regress/regress-crbug-859809.js
Normal file
21
test/mjsunit/regress/regress-crbug-859809.js
Normal file
@ -0,0 +1,21 @@
|
||||
// Copyright 2018 the V8 project authors. All rights reserved.
|
||||
// Use of this source code is governed by a BSD-style license that can be
|
||||
// found in the LICENSE file.
|
||||
|
||||
// Flags: --expose-gc
|
||||
|
||||
let xs = [];
|
||||
const kSize = 200;
|
||||
for (let i = 0; i < kSize; ++i) {
|
||||
xs.push(i);
|
||||
}
|
||||
|
||||
let counter = 0;
|
||||
xs.sort((a, b) => {
|
||||
if (counter++ % 10 == 0) {
|
||||
xs.shift();
|
||||
gc();
|
||||
}
|
||||
|
||||
return a - b;
|
||||
});
|
Loading…
Reference in New Issue
Block a user