src/third_party/mozjs-45/js/src/jit-test/tests/basic/bug1018620.js

String.prototype.search = evalcx('').String.prototype.search;
''.search(/()/);
gcPreserveCode();
gc(this);