The Tor Browser / file comparison
comparison: js/src/jit-test/tests/jaeger/testSetElem-NewProto.js
js/src/jit-test/tests/jaeger/testSetElem-NewProto.js
- changeset 0
- 6474c204b198
equal
deleted
inserted
replaced
| -1:000000000000 | 0:4a87f5dd5517 |
|---|---|
| 1 // vim: set ts=8 sts=4 et sw=4 tw=99: | |
| 2 | |
| 3 function f() { | |
| 4 return [[], [], [], []]; | |
| 5 } | |
| 6 | |
| 7 function setelem(obj, key, val) { | |
| 8 obj[key] = val; | |
| 9 } | |
| 10 | |
| 11 // Generate IC | |
| 12 setelem([], 0, "hi"); | |
| 13 setelem([], 0, "hi"); | |
| 14 | |
| 15 var arrays = f(); | |
| 16 | |
| 17 var evil = { }; | |
| 18 Object.defineProperty(evil, "1", { set: function (v) { this.ham = v; } }); | |
| 19 Array.prototype.__proto__ = evil; | |
| 20 | |
| 21 var k = arrays[0]; | |
| 22 setelem(k, 1, "yam"); | |
| 23 assertEq(k.ham, "yam"); | |
| 24 |
