blob: 8a76e5c09b010bd4e6b24a08628aba9200f61553 (
plain)
1
2
3
4
5
6
7
8
9
|
let iterProto = [].values().__proto__
with (newGlobal()) {
const v3 = [].values();
Object.defineProperty(v3.__proto__, "return", {});
const v18 = [];
for (let i = 0; i < 500; i++) {
[] = v18;
}
}
|