1 files changed, 13 insertions, 0 deletions
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-1402139.js b/deps/v8/test/mjsunit/regress/regress-crbug-1402139.js
new file mode 100644
index 0000000000..ce2ca5eef5
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-1402139.js
@@ -0,0 +1,13 @@
+// Copyright 2022 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+//
+// Flags: --harmony-rab-gsab
+
+const rab = new ArrayBuffer(363, {"maxByteLength": 1000});
+const ta = new Uint8Array(rab);
+rab.resize(80);
+const data = d8.serializer.serialize(ta);
+const dataArray = new Uint8Array(data);
+dataArray[dataArray.length - 1] = 17;
+assertThrows(() => { d8.serializer.deserialize(data); });