v8/test/mjsunit/regress/regress-507980.js
verwaest 0b3d6f7a7d Reload the map of typed arrays after performing ToNumber.
BUG=chromium:507980
LOG=n

Review URL: https://codereview.chromium.org/1234553002

Cr-Commit-Position: refs/heads/master@{#29570}
2015-07-10 12:49:40 +00:00

9 lines
297 B
JavaScript

// Copyright 2015 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
__v_1 = new Float64Array(1);
__v_8 = { valueOf: function() { __v_13.y = "bar"; return 42; }};
__v_13 = __v_1;
__v_13[0] = __v_8;