src/third_party/mozjs-45/js/src/jit-test/tests/closures/bug540131.js

try {
 (function() {
   { let x = (eval("for(y in[0,0,0,0]){}")); }
 })()
} catch(e) {}