src/third_party/mozjs-45/js/src/jit-test/tests/ion/bug836774.js

x = ''.charCodeAt(NaN);
evaluate("for each (var e in [{}, {}, {}, {}, x]) {}");