js/src/jit-test/tests/basic/bug951213.js


1
2
3
4
5
6
7
8


enableShellAllocationMetadataBuilder();
function foo(x, y) {
  this.g = x + y;
}
var a = 0;
var b = { valueOf: function() Object.defineProperty(Object.prototype, 'g', {}) };
var c = new foo(a, b);