JSTests/stress/regress-157322.js

// Regression test for https://bugs.webkit.org/show_bug.cgi?id=157322.  This test should not crash.

let fromArray = [];
let toArray = [];
let dummyArray = [];
let endObj1 = {
    valueOf: function() {
        let originalLength = fromArray.length;
        fromArray.length = 1;

        dummyArray = new Float64Array(1000);

        return originalLength;
    }
};

let endObj2 = {
    valueOf: function() {
        let originalLength = fromArray.length;
        fromArray.length = 1;

        dummyArray = new Float64Array(1000);

        fromArray = [];
        fromArray.length = originalLength;

        return originalLength;
    }
};

let initialArray = [];
for (let i = 0; i < 8000; i++)
        initialArray.push(i + 0.1);

for (let loop = 0; loop < 1000; loop++) {
    fromArray = initialArray.slice(0);

    let endObj = (loop % 2 == 1) ? endObj1 : endObj2;

    // These calls shouldn't crash
    toArray = fromArray.slice(0, endObj);
    toArray = fromArray.splice(0, endObj);
}