v8/test/mjsunit/regress/regress-500173.js
verwaest 72cdb99346 Rely on the map being a dictionary map rather than not having a backpointer
BUG=chromium:500173
LOG=n

Review URL: https://codereview.chromium.org/1194513003

Cr-Commit-Position: refs/heads/master@{#29074}
2015-06-17 10:14:01 +00:00

13 lines
298 B
JavaScript

// Copyright 2015 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
function f(a) {
a.foo = {};
a[0] = 1;
a.__defineGetter__('foo', function() {});
a[0] = {};
a.bar = 0;
}
f(new Array());