24 lines
462 B
JavaScript
24 lines
462 B
JavaScript
description(
|
|
"Tests what happens when you present a CSE opportunity across an out-of-bounds string access."
|
|
);
|
|
|
|
function foo(s, o) {
|
|
var x = o.f;
|
|
s[0];
|
|
var y = o.f;
|
|
return x + y;
|
|
}
|
|
|
|
noInline(foo);
|
|
silentTestPass = true;
|
|
|
|
var theObject = {};
|
|
|
|
String.prototype.__defineGetter__("0", function() { theObject.f = 42; });
|
|
|
|
while (!dfgCompiled({f:foo}))
|
|
shouldBe("foo(\"\", {f:1})", "2");
|
|
|
|
theObject = {f:1};
|
|
shouldBe("foo(\"\", theObject)", "43");
|