v8/test/mjsunit/regress/regress-778668.js
Daniel Clifford d5885ca2b9 Fix splice bug in handling of negative arguments length
Bug: chromium:778668
Change-Id: Ie75f2ecb9e6134b6eb57c7d7fb6ea33cbb2fc2bf
Reviewed-on: https://chromium-review.googlesource.com/753324
Commit-Queue: Daniel Clifford <danno@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49301}
2017-11-10 15:23:28 +00:00

21 lines
461 B
JavaScript

// Copyright 2017 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
(function () {
function f( __v_59960) {
arguments.length = -5;
Array.prototype.slice.call(arguments);
}
f('a')
})();
(function () {
function f( __v_59960) {
arguments.length = 2.3;
print(arguments.length);
Array.prototype.slice.call(arguments);
}
f('a')
})();