3a606b91ef
This fixes the bug where the reducer ignores a prototype that is not initial. Tests are also added. Bug: v8:8056 Change-Id: I428eed2d2790fffa22f67a051f7d1f1e4d3ce947 Reviewed-on: https://chromium-review.googlesource.com/1174542 Reviewed-by: Sigurd Schneider <sigurds@chromium.org> Reviewed-by: Georg Neis <neis@chromium.org> Commit-Queue: Hai Dang <dhai@google.com> Cr-Commit-Position: refs/heads/master@{#55149}
37 lines
767 B
JavaScript
37 lines
767 B
JavaScript
// Copyright 2018 the V8 project authors. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style license that can be
|
|
// found in the LICENSE file.
|
|
|
|
/* Test behaviors when the prototype has elements */
|
|
|
|
// includes
|
|
|
|
(function() {
|
|
const iarr = [,3];
|
|
|
|
function includes(arr, val) {
|
|
return arr.includes(val);
|
|
}
|
|
|
|
assertFalse(includes(iarr, 2));
|
|
assertTrue(includes(iarr, 3));
|
|
|
|
iarr.__proto__ = [2];
|
|
assertTrue(includes(iarr, 2));
|
|
})();
|
|
|
|
// This pollutes the Array prototype, so we should not run more tests
|
|
// in the same environment after this.
|
|
(function () {
|
|
var array = [,];
|
|
|
|
function includes(val) {
|
|
return array.includes(val);
|
|
}
|
|
|
|
assertFalse(includes(6));
|
|
|
|
array.__proto__.push(6);
|
|
assertTrue(includes(6));
|
|
})();
|