From 2aa4a82499d4becd2284cdb482213d541b8804dd Mon Sep 17 00:00:00 2001 From: Daniel Baumann Date: Sun, 28 Apr 2024 16:29:10 +0200 Subject: Adding upstream version 86.0.1. Signed-off-by: Daniel Baumann --- js/src/jit-test/tests/auto-regress/bug1593971.js | 7 +++++++ 1 file changed, 7 insertions(+) create mode 100644 js/src/jit-test/tests/auto-regress/bug1593971.js (limited to 'js/src/jit-test/tests/auto-regress/bug1593971.js') diff --git a/js/src/jit-test/tests/auto-regress/bug1593971.js b/js/src/jit-test/tests/auto-regress/bug1593971.js new file mode 100644 index 0000000000..42ffbbd855 --- /dev/null +++ b/js/src/jit-test/tests/auto-regress/bug1593971.js @@ -0,0 +1,7 @@ +var ta = new Uint32Array(10); + +// Shadow the %TypedArray.prototype%.length getter. +Object.defineProperty(ta, "length", {value: 0x1000}); + +// Call Array.prototype.fill, not %TypedArray.prototype%.fill! +Array.prototype.fill.call(ta, 0); -- cgit v1.2.3