summaryrefslogtreecommitdiffstats
path: root/js/src/jit-test/tests/jaeger/bug617558.js
blob: 1bbd30f21a7785c4faa153c1db7710978ed4af2d (plain)
1
2
3
4
5
6
7
Array.prototype.__proto__ = Function.prototype;
var x = [1,2,3];
x[0];

[].__proto__.foo = true;
eval("[]");