src/third_party/mozjs-45/js/src/jit-test/tests/basic/bug641491.js

function f1() {
}
function f2() {
}
function f3(o) {
    f2 = Date.prototype;
}
var key = Object.getOwnPropertyNames(f1)[30];
if(key) {
    f3 = f1[key];
}
gc(); 
gc();
try {
for(var i=0; i<10; i++) {
    delete f2[1];
    f3(function() {});
}
} catch (e) {}