1 // Copyright 2014 the V8 project authors. All rights reserved. 2 // Use of this source code is governed by a BSD-style license that can be 3 // found in the LICENSE file. 4 5 // Flags: --allow-natives-syntax 6 7 var a = ["string"]; 8 function funky(array) { return array[0] = 1; } 9 funky(a); 10 11 function crash() { 12 var q = [0]; 13 // The failing ASSERT was only triggered when compiling for OSR. 14 for (var i = 0; i < 100000; i++) { 15 funky(q); 16 } 17 q[0] = 0; 18 funky(q) 19 } 20 21 crash(); 22
