src/third_party/mozjs-45/js/src/jit-test/tests/ion/bug892426.js

function selfsetelem(o, i) {
    o[i] = o;
}
var arr = new Array();
selfsetelem(arr, "prop0");
selfsetelem(arr, 0);
selfsetelem(arr, 1);
selfsetelem(arr, 0);
arr.prop0.toString();