src/third_party/mozjs-45/js/src/jit-test/tests/ion/bug861439.js

try {
    x = evalcx('')
    toSource = (function() {
        x = (new WeakMap).get(function() {})
    })
    valueOf = (function() {
        schedulegc(x)
    })
    this + ''
    for (v of this) {}
} catch (e) {}
gc()
this + 1