bug930993.js « ion « tests « jit-test « src « js - firefox - debian 12 backports: mozilla

summary refs log tree commit diff stats

path: root/js/src/jit-test/tests/ion/bug930993.js

blob: bf4074c9182879e1280110d7e90ad6025a3cd1a5 (plain)

x = {};
y = x;
x.toString = function() {
    new Int8Array(ArrayBuffer)[0] = new Float32Array(ArrayBuffer)[0];
}
print(x << y);