src/third_party/mozjs-45/js/src/jit-test/tests/ion/bug980119.js

s = newGlobal()
evalcx("\
    x = new Uint8ClampedArray;\
    x.__proto__ = [];\
", s);
evalcx("\
    x[0]\
", s);