nodejs/deps/v8/test/mjsunit/harmony/regress/regress-crbug-1381656.js
Michaël Zasso 09a8440b45
deps: update V8 to 12.2.281.27
PR-URL: https://github.com/nodejs/node/pull/51362
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
2024-03-31 15:36:07 +02:00

14 lines
550 B
JavaScript

// Copyright 2022 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Returning arguments for a function with 1 parameter results in toSorted code
// initially under-allocating a sorting worklist of length 1 (instead of
// 2). This then results the worklist growing to length 17, with elements 2-16
// being holes. The hole values should not be accessed.
let args = (function(x) {
return arguments;
})(1, 2);
Array.prototype.toSorted.call(args);