27 lines
379 B
JavaScript
27 lines
379 B
JavaScript
var ia = new Int8Array(1024);
|
|
|
|
function foo(o) {
|
|
return o.f;
|
|
}
|
|
|
|
function bar(o) {
|
|
|
|
try {
|
|
o.f = 0x1;
|
|
Uint8Array.prototype.find.call(ia, function () {
|
|
o.f = 0x1;
|
|
}, this);
|
|
} catch (e) {
|
|
}
|
|
|
|
foo(o);
|
|
}
|
|
|
|
var o = new Object();
|
|
o.__defineGetter__("f", function () { });
|
|
|
|
for (var i = 0; i < 1000; ++i) {
|
|
bar({});
|
|
bar(o);
|
|
}
|