js/src/jit-test/tests/jaeger/bug669706.js


1
2
3
4
5
6
7
8
9
10
11
12
13
14

function printStatus(msg) {
    msg.toString()
    lines = msg
    for (var i = 0; i < lines; i++) i
}
var summary = new Float32Array;
try {
    printStatus(summary)
    x = {
    }
    toString.__proto__ = x
} catch (e) {}
var summary = 6;
printStatus(summary)