src/third_party/mozjs-45/js/src/jit-test/tests/baseline/bug877589.js

function x() {
    [1];
}
Array.prototype.__proto__ = {};
x();
Array.prototype.__proto__ = null;
x();