v8/test/mjsunit/regress/regress-crbug-896181.js
peterwmwong 7cb6c81b8f [builtins] Fix Array.p.join handling of an index getter with side effects
When creating the buffer for the fall back, the initial entry was not
considered when calculating the size.

Bug: chromium:896181
Change-Id: I7f15bb1bdf31b3255db91b1fe8dcd68c76033980
Reviewed-on: https://chromium-review.googlesource.com/c/1286957
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Peter Wong <peter.wm.wong@gmail.com>
Cr-Commit-Position: refs/heads/master@{#56768}
2018-10-18 10:46:23 +00:00

15 lines
323 B
JavaScript

// Copyright 2018 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
var a = new Array();
a[0] = 0.1;
a[2] = 0.2;
Object.defineProperty(a, 1, {
get: function() {
a[4] = 0.3;
},
});
assertSame('0.1,,0.2', a.join());