summaryrefslogtreecommitdiff
path: root/deps/v8/test/mjsunit/compiler/regress-944062-2.js
blob: 89f06b545239544dc406beaf9b84e36b000f2d31 (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
// Copyright 2019 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.

// Flags: --allow-natives-syntax

function includes(key, array) {
  // Transition to dictionary mode in the final invocation.
  array.__defineSetter__(key, () => {});
  // Will then read OOB.
  return array.includes(1234);
}
includes("", []);
includes("", []);
%OptimizeFunctionOnNextCall(includes);
includes("", []);
includes("1235", []);