src/third_party/mozjs-45/js/src/jit-test/tests/ion/bug1122839.js

x = '';
Object.defineProperty(this, "y", {
    get: function() {
        return x
    }
})
y
x = 0
x = new String;
y.__proto__ = []
y