src/third_party/mozjs-45/js/src/jit-test/tests/ion/bug1115665.js

Object.prototype[3] = 3
x = Array()
    function f() {
        for (i = 0; i < 9; i++) {
            if (Object[x++] != 0) {}
        }
    }
f()