1.1 --- /dev/null Thu Jan 01 00:00:00 1970 +0000
1.2 +++ b/js/src/jit-test/tests/jaeger/testSetElem-NewProto.js Wed Dec 31 06:09:35 2014 +0100
1.3 @@ -0,0 +1,24 @@
1.4 +// vim: set ts=8 sts=4 et sw=4 tw=99:
1.5 +
1.6 +function f() {
1.7 + return [[], [], [], []];
1.8 +}
1.9 +
1.10 +function setelem(obj, key, val) {
1.11 + obj[key] = val;
1.12 +}
1.13 +
1.14 +// Generate IC
1.15 +setelem([], 0, "hi");
1.16 +setelem([], 0, "hi");
1.17 +
1.18 +var arrays = f();
1.19 +
1.20 +var evil = { };
1.21 +Object.defineProperty(evil, "1", { set: function (v) { this.ham = v; } });
1.22 +Array.prototype.__proto__ = evil;
1.23 +
1.24 +var k = arrays[0];
1.25 +setelem(k, 1, "yam");
1.26 +assertEq(k.ham, "yam");
1.27 +
