1 // Copyright 2014 the V8 project authors. All rights reserved. 2 // Use of this source code is governed by a BSD-style license that can be 3 // found in the LICENSE file. 4 5 // Flags: --allow-natives-syntax 6 7 var b = []; 8 b[10000] = 1; 9 // Required to reproduce the bug. 10 assertTrue(%HasDictionaryElements(b)); 11 12 var a1 = [1.5]; 13 b.__proto__ = a1; 14 assertEquals(1.5, ([].concat(b))[0]); 15 16 var a2 = new Int32Array(2); 17 a2[0] = 3; 18 b.__proto__ = a2 19 assertEquals(3, ([].concat(b))[0]); 20 21 function foo(x, y) { 22 var a = []; 23 a[10000] = 1; 24 assertTrue(%HasDictionaryElements(a)); 25 26 a.__proto__ = arguments; 27 var c = [].concat(a); 28 for (var i = 0; i < arguments.length; i++) { 29 assertEquals(i + 2, c[i]); 30 } 31 assertEquals(undefined, c[arguments.length]); 32 assertEquals(undefined, c[arguments.length + 1]); 33 } 34 foo(2); 35 foo(2, 3); 36 foo(2, 3, 4); 37
