js/src/jit-test/tests/jaeger/bug617558.js

changeset 0
6474c204b198
     1.1 --- /dev/null	Thu Jan 01 00:00:00 1970 +0000
     1.2 +++ b/js/src/jit-test/tests/jaeger/bug617558.js	Wed Dec 31 06:09:35 2014 +0100
     1.3 @@ -0,0 +1,7 @@
     1.4 +
     1.5 +Array.prototype.__proto__ = Function.prototype;
     1.6 +var x = [1,2,3];
     1.7 +x[0];
     1.8 +
     1.9 +[].__proto__.foo = true;
    1.10 +eval("[]");

mercurial