v8/test/mjsunit/regress/regress-crbug-715404.js
bmeurer d06d4ce2c4 [turbofan] Fix lowering of Array constructor with one argument.
Only create a singleton array for Array(len) if Type(len) cannot be
Number, otherwise we might need to throw an exception instead.

BUG=chromium:715404
R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2838123004
Cr-Commit-Position: refs/heads/master@{#44886}
2017-04-26 12:02:12 +00:00

12 lines
359 B
JavaScript

// Copyright 2017 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --allow-natives-syntax
function foo() { Array(-1); }
assertThrows(foo, RangeError);
assertThrows(foo, RangeError);
%OptimizeFunctionOnNextCall(foo);
assertThrows(foo, RangeError);