test262/implementation-contributed/javascriptcore/stress/string-out-of-bounds-negative-proto-value.js
test262-automation e9a5a7f918 [javascriptcore-test262-automation] changes from git@github.com:WebKit/webkit.git at sha 949e26452cfa153a7f4afe593da97e2fe9e1b706 on Tue Jul 03 2018 14:35:15 GMT-0400 (Eastern Daylight Time) (#1620)
* [javascriptcore-test262-automation] changes from git@github.com:WebKit/webkit.git at sha 949e26452cfa153a7f4afe593da97e2fe9e1b706 on Tue Jul 03 2018 14:35:15 GMT-0400 (Eastern Daylight Time)
2018-07-03 15:59:58 -04:00

15 lines
230 B
JavaScript

function foo(s) {
return s[-1];
}
noInline(foo);
String.prototype[-1] = "hello";
for (var i = 0; i < 100000; ++i) {
var result = foo("hello");
if (result != "hello")
throw "Error: bad result: " + result;
}