js/src/jit-test/tests/ion/bug1527148.js


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17

var log = "";
function g() {
    var x = [];
    for (var k = 0; k < 2; ++k) {
        x.push(k);
    }
    log += x;
}
for (var i = 0; i < 1; i++) {
    f = function() {};
}
g();
Array.prototype.push = f;
g();
f.__proto__ = [];
g();
assertEq(log, "0,1");