v8/test/mjsunit/regress/regress-4296.js
verwaest 01f40e6ad6 Fix keyed element access wrt string wrappers
BUG=v8:4296
LOG=n

Review URL: https://codereview.chromium.org/1228063004

Cr-Commit-Position: refs/heads/master@{#29618}
2015-07-13 15:39:07 +00:00

41 lines
907 B
JavaScript

// Copyright 2015 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
(function () {
var o = new String("ab");
function store(o, i, v) { o[i] = v; }
function load(o, i) { return o[i]; }
// Initialize the IC.
store(o, 2, 10);
load(o, 2);
store(o, 0, 100);
assertEquals("a", load(o, 0));
})();
(function () {
var o = {__proto__: new String("ab")};
function store(o, i, v) { o[i] = v; }
function load(o, i) { return o[i]; }
// Initialize the IC.
store(o, 2, 10);
load(o, 2);
store(o, 0, 100);
assertEquals("a", load(o, 0));
})();
(function () {
"use strict";
var o = {__proto__: {}};
function store(o, i, v) { o[i] = v; }
// Initialize the IC.
store(o, 0, 100);
o.__proto__.__proto__ = new String("bla");
assertThrows(function () { store(o, 1, 100) });
})();