v8/test/mjsunit/regress/regress-crbug-618788.js
adamk 7b011fc9db Array splice should only normalize deleted_elements if it's an array
Also slightly expand regression test to end with a return instead of
an exception.

R=cbruni@chromium.org
BUG=chromium:618788

Review-Url: https://codereview.chromium.org/2090193002
Cr-Commit-Position: refs/heads/master@{#37223}
2016-06-23 17:23:20 +00:00

22 lines
780 B
JavaScript

// Copyright 2016 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Slice and splice both try to set the length property of their return
// value. Add a bogus setter to allow that.
Object.defineProperty(Int32Array.prototype, 'length', { set(v) { } });
(function testSlice() {
var a = new Array();
a.constructor = Int32Array;
a.length = 1000; // Make the length >= 1000 so UseSparseVariant returns true.
assertTrue(a.slice() instanceof Int32Array);
})();
(function testSplice() {
var a = new Array();
a.constructor = Int32Array;
a.length = 1000; // Make the length >= 1000 so UseSparseVariant returns true.
assertTrue(a.splice(1) instanceof Int32Array);
})();