Add regression test for crbug.com/v8/7682

Bug: v8:7382,v8:7682
Change-Id: I57aa1658e8136334e18390c422eded3713066728
Reviewed-on: https://chromium-review.googlesource.com/1023394
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52725}

test/mjsunit/mjsunit.status

@@ -203,6 +203,9 @@
 
   # Allocates a huge string and then flattens it, very slow in debug mode.
   'regress/regress-752764': [PASS, ['mode == debug', SLOW]],
+
+  # https://crbug.com/v8/7682
+  'regress/regress-v8-7682': [FAIL],
 }],  # ALWAYS
 
 ['novfp3 == True', {

test/mjsunit/regress/regress-v8-7682.js

+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+const impl = Symbol();
+class MyArrayLike {
+  constructor() {
+    this[impl] = [2, 1];
+    Object.freeze(this);
+  }
+  get 0() { return this[impl][0]; }
+  set 0(value) { this[impl][0] = value; }
+  get 1() { return this[impl][1]; }
+  set 1(value) { this[impl][1] = value; }
+  get length() { return 2; }
+}
+
+const xs = new MyArrayLike();
+Array.prototype.sort.call(xs);
+
+assertEquals(1, xs[0]);
+assertEquals(2, xs[1]);