michael@0: // vim: set ts=8 sts=4 et sw=4 tw=99:
michael@0: 
michael@0: function f() {
michael@0:     return [[], [], [], []];
michael@0: }
michael@0: 
michael@0: function setelem(obj, key, val) {
michael@0:     obj[key] = val;
michael@0: }
michael@0: 
michael@0: // Generate IC
michael@0: setelem([], 0, "hi");
michael@0: setelem([], 0, "hi");
michael@0: 
michael@0: var arrays = f();
michael@0: 
michael@0: var evil = { };
michael@0: Object.defineProperty(evil, "1", { set: function (v) { this.ham = v; } });
michael@0: Array.prototype.__proto__ = evil;
michael@0: 
michael@0: var k = arrays[0];
michael@0: setelem(k, 1, "yam");
michael@0: assertEq(k.ham, "yam");
michael@0: