From 5e03c6ce7bf10477dba8be85a01b46ce537e3c9f Mon Sep 17 00:00:00 2001
From: test262-automation <test262-automation@bocoup.com>
Date: Thu, 6 Sep 2018 18:21:31 +0000
Subject: [PATCH] [javascriptcore-test262-automation] Updated curation log with
 latest revision sha's from export and changed files.    
 sourceRevisionAtLastExport: 3ced8564a6 targetRevisionAtLastExport: f8c62a49f

---
 .../curation_logs/javascriptcore.json         |  4 +--
 .../javascriptcore/stress/regress-189124.js   | 31 +++++++++++++++++++
 2 files changed, 33 insertions(+), 2 deletions(-)
 create mode 100644 implementation-contributed/javascriptcore/stress/regress-189124.js

diff --git a/implementation-contributed/curation_logs/javascriptcore.json b/implementation-contributed/curation_logs/javascriptcore.json
index 8bf7f05d11..8c13dab716 100644
--- a/implementation-contributed/curation_logs/javascriptcore.json
+++ b/implementation-contributed/curation_logs/javascriptcore.json
@@ -1,6 +1,6 @@
 {
-  "sourceRevisionAtLastExport": "3ced8564a6",
-  "targetRevisionAtLastExport": "f8c62a49f",
+  "sourceRevisionAtLastExport": "a2f7b0c562",
+  "targetRevisionAtLastExport": "5594c916b",
   "curatedFiles": {
     "/stress/Number-isNaN-basics.js": "DELETED_IN_TARGET",
     "/stress/Object_static_methods_Object.getOwnPropertyDescriptors-proxy.js": "DELETED_IN_TARGET",
diff --git a/implementation-contributed/javascriptcore/stress/regress-189124.js b/implementation-contributed/javascriptcore/stress/regress-189124.js
new file mode 100644
index 0000000000..cd5532fde4
--- /dev/null
+++ b/implementation-contributed/javascriptcore/stress/regress-189124.js
@@ -0,0 +1,31 @@
+//@ runDefault("--jitPolicyScale=0")
+
+function makeTmp() {
+    let tmp = {a: 1};
+    gc();
+    tmp.__proto__ = {};
+    return tmp;
+}
+
+function foo(tmp, obj) {
+    for (let k in tmp) {
+        tmp.__proto__ = {};
+        gc();
+        obj.__proto__ = {};
+
+        var result = obj[k];
+        return result;
+    }
+}
+
+foo(makeTmp(), {});
+
+let memory = new Uint32Array(100);
+memory[0] = 0x1234;
+
+let fooResult = foo(makeTmp(), memory);
+var result = $vm.value(fooResult);
+
+if (result != "Undefined")
+    throw "FAIL";
+
-- 
GitLab