src/third_party/mozjs-45/js/src/jit-test/tests/basic/bug767273.js

var prox = Proxy.create({
  getOwnPropertyDescriptor: function() { return undefined; },
  has:                      function() { return true; },
});

// Don't crash.
newGlobal().__lookupSetter__.call(prox, "e");