bug615440.js (91B)
1 Array.prototype.__proto__ = null; 2 for (var r = 0; r < 3; ++r) [][0] = 1; 3 4 // Don't crash.
