Version 3.26.31.8 (merged r21903)

test/mjsunit/regress/regress-crbug-387031.js

Index: test/mjsunit/regress/regress-crbug-387031.js
diff --git a/test/mjsunit/regress/regress-347909.js b/test/mjsunit/regress/regress-crbug-387031.js
similarity index 55%
copy from test/mjsunit/regress/regress-347909.js
copy to test/mjsunit/regress/regress-crbug-387031.js
index 90a8e6a759eab76afef1dc968c814bd9d324b147..77f52a9d35ea296d164def9de6f859bcbceb527a 100644
--- a/test/mjsunit/regress/regress-347909.js
+++ b/test/mjsunit/regress/regress-crbug-387031.js
@@ -4,16 +4,12 @@
 
 // Flags: --allow-natives-syntax
 
-var a = {y:1.5};
-a.y = 0;
-var b = a.y;
-a.y = {};
-var d = 1;
-function f() {
-  d = 0;
-  return {y: b};
+a = [1];
+b = [];
+a.__defineGetter__(0, function () {
+  b.length = 0xffffffff;
+});
+c = a.concat(b);
+for (var i = 0; i < 20; i++) {
+  assertEquals(undefined, (c[i]));
 }
-f();
-f();
-%OptimizeFunctionOnNextCall(f);
-f();