v8/test/mjsunit/regress/regress-crbug-668414.js
cbruni a09e5eda26 [runtime] Add missing @@IsConcatSpreadable check for FAST_DOUBLE_ELEMENTS
A missing @@IsConcatSpreadable check caused the fast path inside the slow path
to be incorrect and follow the default concat strategy when the arguments
arrays contain only doubles.

BUG=chromium:668414

Review-Url: https://codereview.chromium.org/2527173002
Cr-Commit-Position: refs/heads/master@{#41301}
2016-11-28 10:06:17 +00:00

59 lines
1.5 KiB
JavaScript

// Copyright 2016 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
(function testSmiArrayConcat() {
var result = [].concat([-12]);
assertEquals(1, result.length);
assertEquals([-12], result);
})();
(function testDoubleArrayConcat() {
var result = [].concat([-1073741825]);
assertEquals(1, result.length);
assertEquals([-1073741825], result);
})();
(function testSmiArrayNonConcatSpreadable() {
var array = [-10];
array[Symbol.isConcatSpreadable] = false;
var result = [].concat(array);
assertEquals(1, result.length);
assertEquals(1, result[0].length);
assertEquals([-10], result[0]);
})();
(function testDoubleArrayNonConcatSpreadable() {
var array = [-1073741825];
array[Symbol.isConcatSpreadable] = false;
var result = [].concat(array);
assertEquals(1, result.length);
assertEquals(1, result[0].length);
assertEquals([-1073741825], result[0]);
})();
Array.prototype[Symbol.isConcatSpreadable] = false;
(function testSmiArray() {
var result = [].concat([-12]);
assertEquals(2, result.length);
assertEquals(0, result[0].length);
assertEquals(1, result[1].length);
assertEquals([-12], result[1]);
})();
(function testDoubleArray() {
var result = [].concat([-1073741825]);
assertEquals(2, result.length);
assertEquals(0, result[0].length);
assertEquals(1, result[1].length);
assertEquals([-1073741825], result[1]);
})();