v8/test/mjsunit/regress/regress-6708.js
Adam Klein fafc3d5e6a [builtins] Array.prototype.concat should set length on return value
Per https://tc39.github.io/ecma262/#sec-array.prototype.concat, step 6.

Bug: v8:6707, v8:6708
Change-Id: Iad3eb94a3b5fe35e5ecd1b8632612a7f2f169434
Reviewed-on: https://chromium-review.googlesource.com/636695
Commit-Queue: Adam Klein <adamk@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47654}
2017-08-28 18:02:48 +00:00

13 lines
340 B
JavaScript

// Copyright 2017 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
var a = [0, 1];
a.constructor = {
[Symbol.species]: function(len) {
var arr = Array(20);
return arr;
}
};
assertEquals([0, 1], Array.prototype.concat.call(a));