v8/test/mjsunit/regress/regress-crbug-1024099.js
Igor Sheludko bc9e4675d0 [builtins] Fix sorting of huge shared TypedArrays
Bug: v8:4153, chromium:1024099
Change-Id: Ia7a53c710ad2e2abcfa6fbc4ea1b2229b8690308
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1914564
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64969}
2019-11-14 21:03:08 +00:00

17 lines
438 B
JavaScript

// Copyright 2019 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
let len = 0x20000;
let ar = new Int32Array(new SharedArrayBuffer(Int32Array.BYTES_PER_ELEMENT * len));
ar[7] = -13;
ar[0x1673] = -42;
ar[0x1f875] = -153;
ar.sort();
assertEquals(ar[0], -153);
assertEquals(ar[1], -42);
assertEquals(ar[2], -13);
assertEquals(ar[3], 0);