nodejs/deps/v8/test/mjsunit/regress/regress-crbug-1069530.js
Michaël Zasso a1d639ba5d
deps: update V8 to 8.6.395
PR-URL: https://github.com/nodejs/node/pull/35415
Reviewed-By: Rich Trott <rtrott@gmail.com>
Reviewed-By: Jiawen Geng <technicalcute@gmail.com>
Reviewed-By: Daniel Bevenius <daniel.bevenius@gmail.com>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Myles Borins <myles.borins@gmail.com>
2020-10-18 20:16:47 +02:00

30 lines
680 B
JavaScript

// Copyright 2020 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --no-lazy-feedback-allocation
function store(ar, index) {
ar[index] = "a";
}
let growable_array = [];
// Train IC on growable array
store(growable_array, 0);
store(growable_array, 1);
store(growable_array, 2);
store(growable_array, 3);
// Now make IC polymorphic
var array = [];
Object.defineProperty(array, "length", { value: 3, writable: false });
store(array, 0);
store(array, 1);
// ... and try to grow it.
store(array, 3);
assertEquals(undefined, array[3]);
assertEquals(3, array.length);