Bug 139194 – Add test for r176506 - ASSERT(!m_vector.isEmpty()) in IntendedStructureChain.cpp(143)

• Status: ASSIGNED
• Component: JavaScriptCore

[Michael Saboff]

A suggested test from https://bugs.webkit.org/show_bug.cgi?id=139000#c5:

var o1 = { __proto__: null, a: 0, b: 0 };
var o2 =  { __proto__: null, a: 0, c: 0 };
var o3 =  { __proto__: null, a: 0, d: 0 };

function access(o)
{
    return o.a;
}

do a lot:
access(o1)
access(o2)
access(o3)