src/third_party/mozjs-45/js/src/jit-test/tests/basic/bug649771.js

function f(o) {
    f = o.constructor;
    eval('delete o.x');
}
for(var i=0; i<3; i++) {
    f(RegExp.prototype);
}