1// Copyright 2014 the V8 project authors. All rights reserved.
2// Use of this source code is governed by a BSD-style license that can be
3// found in the LICENSE file.
4
5// Flags: --allow-natives-syntax
6
7var b = [];
8b[10000] = 1;
9// Required to reproduce the bug.
10assertTrue(%HasDictionaryElements(b));
11
12var a1 = [1.5];
13b.__proto__ = a1;
14assertEquals(1.5, ([].concat(b))[0]);
15
16var a2 = new Int32Array(2);
17a2[0] = 3;
18b.__proto__ = a2
19assertEquals(3, ([].concat(b))[0]);
20
21function foo(x, y) {
22  var a = [];
23  a[10000] = 1;
24  assertTrue(%HasDictionaryElements(a));
25
26  a.__proto__ = arguments;
27  var c = [].concat(a);
28  for (var i = 0; i < arguments.length; i++) {
29    assertEquals(i + 2, c[i]);
30  }
31  assertEquals(undefined, c[arguments.length]);
32  assertEquals(undefined, c[arguments.length + 1]);
33}
34foo(2);
35foo(2, 3);
36foo(2, 3, 4);
37