src/third_party/mozjs-45/js/src/jit-test/tests/basic/bug830045.js

Array.prototype[1] = 'y';
var a = [0, (8)];
for (var i in a) {
    delete a[1];
}