v8/test/mjsunit/regress/regress-crbug-583257.js
jkummerow d582d2bb2a More *_STRING_WRAPPER_ELEMENTS fixes
BUG=chromium:583257
LOG=n
R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/1651253003

Cr-Commit-Position: refs/heads/master@{#33683}
2016-02-02 13:51:00 +00:00

28 lines
650 B
JavaScript

// Copyright 2015 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
Object.defineProperty(String.prototype, "0", { __v_1: 1});
Object.defineProperty(String.prototype, "3", { __v_1: 1});
(function () {
var s = new String();
function set(object, index, value) { object[index] = value; }
set(s, 10, "value");
set(s, 1073741823, "value");
})();
function __f_11() {
Object.preventExtensions(new String());
}
__f_11();
__f_11();
(function() {
var i = 10;
var a = new String("foo");
for (var j = 0; j < i; j++) {
a[j] = {};
}
})();