src/third_party/mozjs-45/js/src/jit-test/tests/basic/bug777992.js

verifyprebarriers()
x = []
function z() {}
Object.defineProperty(x, 2, {
    value: z
})
gczeal(2, 2)
y = x.slice(2)
y.e = (function() {})