From a0f80eddde18343cf3cd167e910e9beba19f2f81 Mon Sep 17 00:00:00 2001 From: "adamk@chromium.org" Date: Tue, 7 Oct 2014 19:22:44 +0000 Subject: [PATCH] Add test case demonstrating bug in SparseReverse when combined with getters/setters BUG=v8:3612 LOG=N R=mstarzinger@chromium.org Review URL: https://codereview.chromium.org/628383002 git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24443 ce2b1a6d-e550-0410-aec6-3dcde31c8c00 --- test/mjsunit/bugs/bug-3612.js | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+) create mode 100644 test/mjsunit/bugs/bug-3612.js diff --git a/test/mjsunit/bugs/bug-3612.js b/test/mjsunit/bugs/bug-3612.js new file mode 100644 index 0000000..8c30ebf --- /dev/null +++ b/test/mjsunit/bugs/bug-3612.js @@ -0,0 +1,21 @@ +// Copyright 2014 the V8 project authors. All rights reserved. +// Use of this source code is governed by a BSD-style license that can be +// found in the LICENSE file. + +var a = [1]; +var getterValue = 2; +var endIndex = 0xffff; +Object.defineProperty(a, endIndex, { + get: function() { + this[1] = 3; + return getterValue; + }, + set: function(val) { + getterValue = val; + }, + configurable: true, + enumerable: true +}); +a.reverse(); +assertFalse(a.hasOwnProperty(1)); +assertEquals(3, a[endIndex-1]); -- 2.7.4