/js/src/jit-test/tests/jaeger/bug669706.js

 1function printStatus(msg) {
 2    msg.toString()
 3    lines = msg
 4    for (var i = 0; i < lines; i++) i
 5}
 6var summary = new Float32Array;
 7try {
 8    printStatus(summary)
 9    x = {
10    }
11    toString.__proto__ = x
12} catch (e) {}
13var summary = 6;
14printStatus(summary)