js/src/jit-test/tests/auto-regress/bug666599.js


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17

// |jit-test| error:TypeError

// Binary: cache/js-dbg-32-0428dbdf3d58-linux
// Flags:
//
o1 = new Float32Array().buffer
o2 = ArrayBuffer.prototype
o3 = new Uint32Array().buffer
for (i = 0; i < 2; i++) {
    for (var x in o2) {
        o3.__defineGetter__("", function() {})
    }
    o2.__defineGetter__("", function() {})
    o1[
    x]
    o1.__proto__ = o3
}