bug1502143.js (288B)
1 setJitCompilerOption("baseline.warmup.trigger", 10); 2 setJitCompilerOption("ion.warmup.trigger", 100); 3 4 main(); 5 6 function main() { 7 new Uint8Array(1024).buffer; 8 var b = []; 9 b[10000] = 1; 10 [].concat(b) 11 var a2 = new Int32Array(2); 12 b.__proto__ = a2; 13 [].concat(b) 14 }