Bug 1902907 Comment 1 Edit History

Note: The actual edited comment in the bug view page will always show the original commenter’s name and original timestamp.

Original comment by
on 
Reduced test below.
```js
Object.defineProperty(RegExp.prototype, "flags", {get: function() {
    Array.prototype.push.call(this);
}});
function f() {
    var s = disassemble();
    for (var i = 0; i < 200; i++) {
        s.replace(/0./);
    }
}
f();
```
Revision 1 by
on 
Reduced test below.
```js
// --fast-warmup --no-threads
Object.defineProperty(RegExp.prototype, "flags", {get: function() {
    Array.prototype.push.call(this);
}});
function f() {
    var s = disassemble();
    for (var i = 0; i < 200; i++) {
        s.replace(/0./);
    }
}
f();
```

Back to Bug 1902907 Comment 1