v8/test/mjsunit/regress/regress-crbug-899535.js
Tobias Tebbi f942791b80 [elements] fix wrong cast of empty FixedArray in Array.prototype.includes
Bug: chromium:899535
Change-Id: I468912afca9187b47ae94fbbcff79e175fa1e686
Reviewed-on: https://chromium-review.googlesource.com/c/1304296
Reviewed-by: Caitlin Potter <caitp@igalia.com>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57101}
2018-10-29 20:37:03 +00:00

7 lines
244 B
JavaScript

// Copyright 2018 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
let a = [1.1, 2.2, 3.3];
a.includes(4.4, { toString: () => a.length = 0 });