// Copyright 2014 the V8 project authors. All rights reserved. // Use of this source code is governed by a BSD-style license that can be // found in the LICENSE file. // Flags: --allow-natives-syntax --enable-slow-asserts function f() { var x = new Array(0); x[-1] = -1; Object.observe(x, function() { }); } f(); f();