src/third_party/mozjs-45/js/src/jit-test/tests/basic/bug1141338.js

z = [];
m = evalcx("");
Object.freeze(m);
for each(l in [{}, {}]) {
  m.s = "";
}