The Tor Browser / file diff

     1.1 --- /dev/null	Thu Jan 01 00:00:00 1970 +0000
     1.2 +++ b/js/src/jit-test/tests/ion/bug784385.js	Wed Dec 31 06:09:35 2014 +0100
     1.3 @@ -0,0 +1,9 @@
     1.4 +Object.defineProperty(Object.prototype, "a", {
     1.5 +    set: function(a) { eval(""); return 123; }
     1.6 +});
     1.7 +var obj = {};
     1.8 +var obj2 = {x: 1};
     1.9 +for (var i = 0; i < 100; i++) {
    1.10 +    var res = (obj.a = obj2);
    1.11 +    res.x = 0xbeef;
    1.12 +}