bug1502709.js (394B)
1 setJitCompilerOption("baseline.warmup.trigger", 0); 2 main(); 3 4 function main() { 5 try { 6 x = []; 7 Object.defineProperty(x, 1, {}); 8 y = []; 9 Object.defineProperty(y, 1, {}); 10 y.__proto__ = null; 11 Array.prototype.sort.apply(x, [function() {}]); 12 } catch (e) {} 13 try { 14 Array.prototype.sort.apply(y, [function() {}]); 15 } catch (e) {} 16 }