LayoutTests/js/array-sort-crash.html

<!DOCTYPE HTML>
<html>
<head>
<script src="../resources/js-test-pre.js"></script>
<script>
function foo() {
    var N = 12288; // 3000h
    var W = Array.prototype.constructor.apply(null, new Array(N));
    var z = {};
    z.toString = function() {
        W.push(12345);
        return ""
    };
    W[0] = z;
    W.sort();
}
</script>
</head>
<body onclick="foo()">
<div>This test passes if it does not crash.</div>
<script src="../resources/js-test-post.js"></script>
</body>
</html>