test262/implementation-contributed/javascriptcore/stress/regress-187373-2.js

//@ runDefault("--useControlFlowProfiler=true")

function foo() {
    for (var x in []) {
        o[++x];
    }
}
foo()