js/src/jit-test/tests/auto-regress/bug479747.js


1
2
3
4
5
6
7
8
9

// |jit-test| error:TypeError

// Binary: cache/js-dbg-32-9174e1bbfa9f-linux
// Flags: -j
//
'a'.replace(/a/g, [].push);
x = [];
x++;
(function(){ eval("for(let y in []) [][x]"); })();