src/third_party/mozjs-45/js/src/jit-test/tests/ion/bug792220.js

var p = Proxy.create({
  has : function(id) {}
});
RegExp.prototype.__proto__ = p;
function f() {
  if (/a/.exec("a"))
    return 1;
  return 0;
}
delete RegExp.prototype.test;
f();