src/third_party/mozjs-45/js/src/jit-test/tests/auto-regress/bug479747.js

// |jit-test| error:TypeError

// Binary: cache/js-dbg-32-9174e1bbfa9f-linux
// Flags: -j
//
'a'.replace(/a/g, [].push);
x = [];
x++;
(function(){ eval("for(let y in []) [][x]"); })();