bug1888892.js (240B)
1 function f() { 2 try { arr.toReversed(); } catch (e) {} 3 var proxy = new Proxy(Object.prototype, {get() {}}); 4 Object.setPrototypeOf(Array.prototype, proxy); 5 } 6 gczeal(10); 7 var arr = []; 8 Object.defineProperty(arr, 0, {get: f}); 9 f();