src/third_party/mozjs-45/js/src/jit-test/tests/ion/bug995673.js

var total = 0

x = [ [] ]
x[0].valueOf = function () {
  total++;
}
function f(y) {
    y != Math.abs()
}
(function() {
    f()
    f(x[0])
    f(x[0])
})()

assertEq(total, 2)