Merged r11533 into 3.8 branch.

test/mjsunit/regress/regress-117409.js

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
 //       with the distribution.
 //     * Neither the name of Google Inc. nor the names of its
 //       contributors may be used to endorse or promote products derived
 //       from this software without specific prior written permission.
 //
 // THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
 // "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
 // LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
 // A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
 // OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
 // SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
 // LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
 // DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
 // THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
-// Flags: --expose-debug-as debug
-var Debug = debug.Debug;
+// Flags: --expose-gc
 
-function listener(event, exec_state, event_data, data) {
-  for (var i = 0, n = exec_state.frameCount(); i < n; i++) {
-    exec_state.frame().scopeCount(i);
-  }
-  exec_state.prepareStep(Debug.StepAction.Continue, 1);
-}
+function KeyedStoreIC(a) { a[0] = Math.E; }
 
-Debug.setListener(listener);
+// Create literal with a fast double elements backing store
+var literal = [1.2];
 
-var F = function () {
-  1, function () {
-    var d = 0;
-    (function () { d; });
-    debugger;
-  }();
-};
+// Specialize the IC for fast double elements
+KeyedStoreIC(literal);
+KeyedStoreIC(literal);
 
-var src = "(" + F.toString() + ")()";
-eval(src);
+// Trruncate array to 0 elements, at which point backing store will be replaced
+// with empty fixed array.
+literal.length = 0;
 
-Function.prototype.__defineGetter__("f", function () {
-  debugger;
-  return 0;
-});
+// ArrayPush built-in will replace empty fixed array backing store with 19
+// elements fixed array backing store.  This leads to a mismatch between the map
+// and the backing store.  Debug mode will crash here in set_elements accessor.
+literal.push(Math.E, Math.E);
 
-var G = function () {
-  1, function () {
-    var d = 0;
-    (function () { d; });
-    debugger;
-  }['f'];
-};
+// Corrupt the backing store!
+KeyedStoreIC(literal);
 
-var src = "(" + G.toString() + ")()";
-eval(src);
+// Release mode will crash here when trying to visit parts of E as pointers.
+gc();