js/src/jit-test/tests/jaeger/testSetElem-NewProto.js


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24

// vim: set ts=8 sts=4 et sw=4 tw=99:

function f() {
    return [[], [], [], []];
}

function setelem(obj, key, val) {
    obj[key] = val;
}

// Generate IC
setelem([], 0, "hi");
setelem([], 0, "hi");

var arrays = f();

var evil = { };
Object.defineProperty(evil, "1", { set: function (v) { this.ham = v; } });
Array.prototype.__proto__ = evil;

var k = arrays[0];
setelem(k, 1, "yam");
assertEq(k.ham, "yam");