js/src/jit-test/tests/gc/bug-906243.js


1
2
3
4
5
6
7
8
9
10
11
12

a2 = []
g = function() r
Object.defineProperty(a2, 0, {
    set: function() {}
})
for (var x = 0; x < 70; ++x) {
    Array.prototype.unshift.call(a2, g)
}
a2.length = 8
for each(e in [0, 0]) {
    Array.prototype.shift.call(a2)
}