js/src/jit-test/tests/basic/bug641491.js


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19

function f1() {
}
function f2() {
}
function f3(o) {
    f2 = Date.prototype;
}
var key = Object.getOwnPropertyNames(f1)[30];
if(key) {
    f3 = f1[key];
}
gc(); 
gc();
try {
for(var i=0; i<10; i++) {
    delete f2[1];
    f3(function() {});
}
} catch (e) {}