tor-browser

The Tor Browser
git clone https://git.dasho.dev/tor-browser.git
Log | Files | Refs | README | LICENSE

species-fuse-3.js (487B)

      1 // Ensure the species fuse triggers invalidation.
      2 
      3 function useSpecies(arr, func) {
      4  return arr.map(func);
      5 }
      6 function f() {
      7  with (this) {} // Don't Ion-compile.
      8 
      9  var arr = [1, 2, 3];
     10  var func = x => x;
     11 
     12  var counter = 0;
     13  for (var i = 0; i < 5000; i++) {
     14    useSpecies(arr, func);
     15    if (i === 4800) {
     16      Object.defineProperty(Array.prototype, "constructor", {get: function() {
     17        counter++;
     18        return Array;
     19      }});
     20    }
     21  }
     22  assertEq(counter, 199);
     23 }
     24 f();