src/third_party/mozjs-45/js/src/jit-test/tests/basic/bug1113980.js

var p = Proxy.create({
    getOwnPropertyDescriptor: function() {
        return {value: 1, configurable: true, writable: true};
    },
    defineProperty: function() {
    }
}, null);

var o = Object.create(p);
o.a = 1;