JSTests/stress/for-in-shadow-prototype-property.js

(function() {
    // Add a property to the base object that shadows a property in the prototype during iteration.
    var foo = function() {
        var A = function() {};
        A.prototype.x = "A.x";
        A.prototype.y = "A.y";
        var o = new A();
        var result = "";
        for (var p in o) {
            if (p == "x")
                o.y = "o.y";
            result += o[p];
        }
        return result;
    };
    noInline(foo);
    for (var i = 0; i < 10000; ++i) {
        if (foo() !== "A.xo.y")
            throw new Error("bad result");
    }
    foo(null);
})();