src/third_party/mozjs-45/js/src/jit-test/tests/basic/bug673469.js

var a = Boolean();
false.__proto__;
var c = ({}).__proto__;
var d = {};
gc()
c[0] = d;
for (var x in a) {
  a[x];
}