src/third_party/mozjs-45/js/src/jit-test/tests/basic/bug1190733.js

x = [];
Array.prototype.push.call(x, Uint8ClampedArray);
(function() {
    x.length = 9;
})();
Array.prototype.reverse.call(x);