[Webkit-unassigned] [Bug 35730] Crashes after delete Array.prototype

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=35730





--- Comment #1 from Peter Leonov <gojpeg at gmail.com>  2010-03-04 02:50:29 PST ---
Cut from that page:

function blablabla (m)
{
    [].push()
    m.constructor === Array
}

function crash ()
{
    Array.prototype.xxx6 = 123
    blablabla(123)
    delete Array.prototype.xxx6
    blablabla([])

    new Array().join()

    {
        [].sort()
    }
}

crash()

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.