bug1593971.js (235B)
1 var ta = new Uint32Array(10); 2 3 // Shadow the %TypedArray.prototype%.length getter. 4 Object.defineProperty(ta, "length", {value: 0x1000}); 5 6 // Call Array.prototype.fill, not %TypedArray.prototype%.fill! 7 Array.prototype.fill.call(ta, 0);