src/third_party/mozjs-45/js/src/jit-test/tests/ion/bug861419.js

arguments = [];
try {
    arguments.toSource = (function() {
        __proto__.y = x
    })
    y = this
    print(x = 8)
    a = arguments
    for (v of this) {}
} catch (e) {}
function f() {
  "HELLO " + y
}
f()
f()
y = 1[7]
f()