| OLD | NEW |
| 1 // Copyright 2014 the V8 project authors. All rights reserved. | 1 // Copyright 2014 the V8 project authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 delete Object.prototype.__proto__; | 5 // Flags: --allow-natives-syntax --verify-heap |
| 6 | 6 function f(a) { |
| 7 function f() { | 7 for (var i = 0; i < 256; i++) a[i] = i; |
| 8 this.toString = 1; | |
| 9 } | 8 } |
| 10 | 9 |
| 11 f.apply({}); | 10 f([]); |
| 12 f(); | 11 f([]); |
| 12 f(this); |
| OLD | NEW |