src/third_party/mozjs-45/js/src/jit-test/tests/basic/bug951213.js

enableShellObjectMetadataCallback();
function foo(x, y) {
  this.g = x + y;
}
var a = 0;
var b = { valueOf: function() Object.defineProperty(Object.prototype, 'g', {}) };
var c = new foo(a, b);