regress-141883.js   [plain text]

// This test is taken almost literally from the bug report: https://bugs.webkit.org/show_bug.cgi?id=141883.
// The only change is to use a loop bound of 1e4 instead of 1e5 to make the test run faster. This
// change still caused a reliable crash in every optimizing JIT configuration prior to the fix.

(function() {
var b=!2;
var n = 1e4;
for(i = 0; i< n; i++) {
b[b=this];
for (var i = 0; i < n; i++) {
  if (a = b*3) {
  }
}
}
})()