js/src/jit-test/tests/basic/bug572232.js


1
2
3
4

// |jit-test| error: TypeError
gczeal(11);
var o = { valueOf: function() { new Object(); gc(); return 17; } };
(new String.prototype.substring(o)).toString;