Index: test/mjsunit/bugs/bug-3621.js |
diff --git a/test/mjsunit/bugs/bug-3621.js b/test/mjsunit/bugs/bug-3621.js |
new file mode 100644 |
index 0000000000000000000000000000000000000000..16ddde16961cd0cbd42d0d64118a85a0241ee9c2 |
--- /dev/null |
+++ b/test/mjsunit/bugs/bug-3621.js |
@@ -0,0 +1,11 @@ |
+// Copyright 2014 the V8 project authors. All rights reserved. |
+// Use of this source code is governed by a BSD-style license that can be |
+// found in the LICENSE file. |
+ |
+var a = []; |
+var endIndex = 0xffff; |
+a[endIndex] = 3; |
+Object.defineProperty(a, 0, { get: function() { this[1] = 2; return 1; } }); |
+assertEquals('123', a.join('')); |
+delete a[1]; // reset the array |
+assertEquals('1,2,', a.join().slice(0, 4)); |