michael@0: // |jit-test| error: ReferenceError
michael@0: // vim: set ts=8 sts=4 et sw=4 tw=99:
michael@0: 
michael@0: // Note: modified from original test, which used Uint32Array in place of Array,
michael@0: // because the behavior has changed in a way that this will throw a TypeError
michael@0: // before it gets to testing what used to crash. I have no idea whether this
michael@0: // would actually crash the original version it was written for.
michael@0: try {
michael@0:     (function () {
michael@0:         __proto__ = Array()
michael@0:     }())
michael@0: } catch (e) {}(function () {
michael@0:     length, ([eval()] ? x : 7)
michael@0: })()