| OLD | NEW | 
|---|
| 1 // Copyright 2014 the V8 project authors. All rights reserved. | 1 // Copyright 2014 the V8 project authors. All rights reserved. | 
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be | 
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. | 
| 4 | 4 | 
| 5 // Flags: --allow-natives-syntax | 5 // Flags: --allow-natives-syntax | 
| 6 | 6 | 
| 7 // The bug 349885 | 7 a = [1]; | 
| 8 | 8 b = []; | 
| 9 function foo(a) { | 9 a.__defineGetter__(0, function () { | 
| 10   a[292755462] = new Object(); | 10   b.length = 0xffffffff; | 
|  | 11 }); | 
|  | 12 c = a.concat(b); | 
|  | 13 for (var i = 0; i < 20; i++) { | 
|  | 14   assertEquals(undefined, (c[i])); | 
| 11 } | 15 } | 
| 12 foo(new Array(5)); |  | 
| 13 foo(new Array(5)); |  | 
| 14 %OptimizeFunctionOnNextCall(foo); |  | 
| 15 foo(new Array(10)); |  | 
| OLD | NEW | 
|---|