src/third_party/mozjs-45/js/src/jit-test/tests/ion/bug819611.js

// |jit-test| ion-eager
x = [0, 0]
Object.freeze(x).map(function() {
    x.length = 6
})
assertEq(x.length,2);