js/src/jit-test/tests/warp/bug1789821.js


1
2
3
4
5
6
7
8
9
10
11
12
13
14

function foo(x) {
  Math.max(...[x]);
}

with ({}) {}
for (let i = 0; i < 100; i++) {
  foo(0);
}

let called = false;
const evil = { valueOf: () => { called = true; } };
foo(evil);

assertEq(called, true);