js/src/jit-test/tests/gc/bug-1556155.js


1
2
3
4
5
6

a = [];
minorgc();
Object.defineProperty(a, 12, {}).push(1);
toString = (function() { return a.reverse(); });
oomTest(Date.prototype.toJSON);
oomTest(Date.prototype.toJSON);