v8/test/mjsunit/regress/regress-v8-7682.js
jgruber 7b4286b84f Add regression test for crbug.com/v8/7682
Bug: v8:7382,v8:7682
Change-Id: I57aa1658e8136334e18390c422eded3713066728
Reviewed-on: https://chromium-review.googlesource.com/1023394
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52725}
2018-04-23 10:58:15 +00:00

23 lines
581 B
JavaScript

// Copyright 2018 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
const impl = Symbol();
class MyArrayLike {
constructor() {
this[impl] = [2, 1];
Object.freeze(this);
}
get 0() { return this[impl][0]; }
set 0(value) { this[impl][0] = value; }
get 1() { return this[impl][1]; }
set 1(value) { this[impl][1] = value; }
get length() { return 2; }
}
const xs = new MyArrayLike();
Array.prototype.sort.call(xs);
assertEquals(1, xs[0]);
assertEquals(2, xs[1]);