1 files changed, 27 insertions, 0 deletions
diff --git a/js/src/jit-test/tests/basic/bug535474.js b/js/src/jit-test/tests/basic/bug535474.js
new file mode 100644
index 0000000000..6e34298a2b
--- /dev/null
+++ b/js/src/jit-test/tests/basic/bug535474.js
@@ -0,0 +1,27 @@
+function f() {
+  var _76 = {};
+  for (var i = 0; i < arguments.length; i++) {
+    var typ = arguments[i];
+    _76[typ] = typ;
+  }
+  return function () {
+    for (var i = 0; i < arguments.length; i++) {
+      if (!(typeof (arguments[i]) in _76)) {
+        return false;
+      }
+    }
+    return true;
+  }
+}
+
+g = f("number", "boolean", "object");
+
+g("a", "b", "c", "d", "e", "f", 2);
+g(2, "a", "b", "c", "d", "e", "f", 2);
+
+/*
+ * Don't assert --
+ * Assertion failed: frame entry -4 wasn't freed
+ * : _activation.entry[i] == 0 (../nanojit/Assembler.cpp:786)
+ */
+