bug1335619.js (326B)
1 // jsfunfuzz-generated 2 x = []; 3 y = x.push(Set, 1); 4 Array.prototype.shift.call(x); 5 // Adapted from randomly chosen test: js/src/tests/ecma_5/String/match-defines-match-elements.js 6 Object.defineProperty(Array.prototype, 1, { 7 set: function() {} 8 }) 9 // jsfunfuzz-generated 10 Array.prototype.splice.call(x, 3, {}, y); 11 new Set(x);