summaryrefslogtreecommitdiffstats
path: root/js/src/jit-test/tests/ion/bug800179.js
diff options
context:
space:
mode:
Diffstat (limited to '')
-rw-r--r--js/src/jit-test/tests/ion/bug800179.js24
1 files changed, 24 insertions, 0 deletions
diff --git a/js/src/jit-test/tests/ion/bug800179.js b/js/src/jit-test/tests/ion/bug800179.js
new file mode 100644
index 0000000000..91b9d87db2
--- /dev/null
+++ b/js/src/jit-test/tests/ion/bug800179.js
@@ -0,0 +1,24 @@
+// |jit-test| error: TypeError
+
+try {
+ x = []
+ y = function() {}
+ t = Uint8ClampedArray
+ Object.defineProperty(x, 1, {
+ get: (function() {
+ for (v of t) {}
+ })
+ })
+ Object.defineProperty(x, 8, {
+ configurable: t
+ }).reverse()
+} catch (e) {}
+Object.defineProperty([], 1, {
+ configurable: true,
+ get: (function() {
+ for (j = 0; j < 50; ++j) {
+ y()
+ }
+ })
+}).pop()
+x.map(y)