1 // Copyright 2014 the V8 project authors. All rights reserved. 2 // Use of this source code is governed by a BSD-style license that can be 3 // found in the LICENSE file. 4 5 // Flags: --allow-natives-syntax --enable-slow-asserts 6 7 var arr = []; 8 var str = new String('x'); 9 10 function f(a,b) { 11 a[b] = 1; 12 } 13 14 f(arr, 0); 15 f(str, 0); 16 f(str, 0); 17 18 // This is just to trigger elements validation, object already broken. 19 %SetProperty(str, 1, 'y', 0); 20
