618150 - TM: testApplyCall.js fails after setting Arrray.prototype.__proto__

Status: RESOLVED DUPLICATE of bug 618350

(Core :: JavaScript Engine, defect)

Description

[Jan de Mooij [:jandem]]

Attachment: Test case

Attached test case fails with -j.

Comment 1

[Luke Wagner [:luke]]

I wanted to be sure this wasn't some exploitable fallout from bug 605192, but I reduced way past f.apply.  I got it down to this:

  > Object.defineProperty(Object.prototype, 0, {});
  > assertEq([42][0], 42);
  test.js:2: Error: Assertion failed: got (void 0), expected 42

Comment 2

[Luke Wagner [:luke]]

(This fails in the interp)