src/third_party/mozjs-45/js/src/jit-test/tests/jaeger/bug653249.js

function testUnaryImacros() {
    function checkArg(x) {
        o = {
            valueOf: checkArg
        }
    }
    var v = 0;
    v += +toString;
    for (var i = 0; i;) {
        v += [].checkArg.checkArg;
    }
}(testUnaryImacros(), "valueOf passed, toString passed");