// Copyright 2018 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.

// a has packed SMI elements
a = [];

// a has dictionary elements
a.length = 0xFFFFFFF;

// a has dictionary elements and the backing array is
// empty_slow_element_dictionary (length 0)
a.length = 0;

// a has dictionary elements and the backing array is
// empty_slow_element_dictionary (length 0xFFFFFFF)
a.length = 0xFFFFFFF;

// This will crash if V8 attempts to remove 0 elements from
// empty_slow_element_dictionary as it is in RO_SPACE.
a.length = 1;