1 files changed, 44 insertions, 0 deletions
diff --git a/js/src/jit-test/tests/auto-regress/bug557946.js b/js/src/jit-test/tests/auto-regress/bug557946.js
new file mode 100644
index 0000000000..8d1e95c53b
--- /dev/null
+++ b/js/src/jit-test/tests/auto-regress/bug557946.js
@@ -0,0 +1,44 @@
+// Binary: cache/js-dbg-64-6f1a38b94754-linux
+// Flags: -j
+//
+/* vim: set ts=8 sts=4 et sw=4 tw=99: */
+
+var x = 0;
+var y = 0;
+
+function h() {
+    if (x == 1)
+        y++;
+    else
+        y--;
+}
+
+function F() {
+    var m = null;
+
+    function g(i) {
+        /* Force outgoing typemaps to have a string. */
+        m = "badness";
+
+        /* Loop a bit. */
+        for (var i = 0; i < 10; i++) {
+            h();
+        }
+    }
+
+    /* Spin for a while so trees build. */
+    for (var i = 0; i < 100; i++) {
+        /* Capture m == TT_NULL in outgoing fi for rp[0] */
+        g();
+
+        /* Flip the switch to bail out with deep nested frames. */
+        if (i > 50)
+            x = 1;
+
+        /* Set m = null on the loop tail to get better traces. */
+        m = null;
+    }
+}
+
+F();
+