JSTests/stress/for-in-postfix-ignored-index.js

//@ runDefault

function foo(o) {
    var result = 0;
    for (var s in o) {
        s++;
        result += o[s];
    }
    return result;
}

var result = foo({f:42});
if ("" + result != "NaN")
    throw "Error: bad result: " + result;