Sign in
webkit
/
WebKit
/
5018b83b58300de6a946efbfe8a7056c14da27e0
/
.
/
JSTests
/
stress
/
string-out-of-bounds-negative-proto-value.js
blob: cb480504f3792a001e91fddfadf1f7d7f2f2b030 [
file
] [
log
] [
blame
]
function
foo
(
s
)
{
return
s
[-
1
];
}
noInline
(
foo
);
String
.
prototype
[-
1
]
=
"hello"
;
for
(
var
i
=
0
;
i
<
100000
;
++
i
)
{
var
result
=
foo
(
"hello"
);
if
(
result
!=
"hello"
)
throw
"Error: bad result: "
+
result
;
}