src/third_party/mozjs-45/js/src/jit-test/tests/jaeger/bug767961.js

function C() {
  this.x = this[this.y = "foo"]--;
}

// Don't crash.
new C;