src/third_party/mozjs-45/js/src/jit-test/tests/jaeger/bug669706.js

function printStatus(msg) {
    msg.toString()
    lines = msg
    for (var i = 0; i < lines; i++) i
}
var summary = new Float32Array;
try {
    printStatus(summary)
    x = {
    }
    toString.__proto__ = x
} catch (e) {}
var summary = 6;
printStatus(summary)