src/third_party/mozjs-45/js/src/jit-test/tests/TypedObject/fuzz3.js

// |jit-test| error:RangeError;
load(libdir + "immutable-prototype.js");

if (!this.hasOwnProperty("TypedObject"))
  throw new RangeError();

if (globalPrototypeChainIsMutable())
  this.__proto__ =  Proxy.create({});

new TypedObject.StructType;