src/third_party/mozjs-45/js/src/jit-test/tests/basic/testOverRecursed3.js

// |jit-test| error:InternalError

var x = [];
x.push(x, x); // more than one so the sort can't be optimized away
x.toString = x.sort;
x.toString();