src/third_party/mozjs-45/js/src/jit-test/tests/basic/testFunApplyMisspeculation.js

var h = { apply:function() { return "ponies"; } };
function f() { var x = 3; g = function() { return ++x }; return h.apply(null, arguments) }
assertEq(f(), "ponies");