| OLD | NEW |
| 1 // Copyright 2014 the V8 project authors. All rights reserved. | 1 // Copyright 2014 the V8 project authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 // Flags: --allow-natives-syntax | 5 // Flags: --allow-natives-syntax |
| 6 | 6 |
| 7 // The bug 349885 | 7 a = [1]; |
| 8 | 8 b = []; |
| 9 function foo(a) { | 9 a.__defineGetter__(0, function () { |
| 10 a[292755462] = new Object(); | 10 b.length = 0xffffffff; |
| 11 }); |
| 12 c = a.concat(b); |
| 13 for (var i = 0; i < 20; i++) { |
| 14 assertEquals(undefined, (c[i])); |
| 11 } | 15 } |
| 12 foo(new Array(5)); | |
| 13 foo(new Array(5)); | |
| 14 %OptimizeFunctionOnNextCall(foo); | |
| 15 foo(new Array(10)); | |
| OLD | NEW |