The Tor Browser / file diff

     1.1 --- /dev/null	Thu Jan 01 00:00:00 1970 +0000
     1.2 +++ b/js/src/jit-test/tests/auto-regress/bug666599.js	Wed Dec 31 06:09:35 2014 +0100
     1.3 @@ -0,0 +1,17 @@
     1.4 +// |jit-test| error:TypeError
     1.5 +
     1.6 +// Binary: cache/js-dbg-32-0428dbdf3d58-linux
     1.7 +// Flags:
     1.8 +//
     1.9 +o1 = new Float32Array().buffer
    1.10 +o2 = ArrayBuffer.prototype
    1.11 +o3 = new Uint32Array().buffer
    1.12 +for (i = 0; i < 2; i++) {
    1.13 +    for (var x in o2) {
    1.14 +        o3.__defineGetter__("", function() {})
    1.15 +    }
    1.16 +    o2.__defineGetter__("", function() {})
    1.17 +    o1[
    1.18 +    x]
    1.19 +    o1.__proto__ = o3
    1.20 +}