1 files changed, 31 insertions, 0 deletions
diff --git a/js/src/jit-test/tests/basic/bug656261.js b/js/src/jit-test/tests/basic/bug656261.js
new file mode 100644
index 0000000000..7a3b61d213
--- /dev/null
+++ b/js/src/jit-test/tests/basic/bug656261.js
@@ -0,0 +1,31 @@
+function build_getter(i) {
+    var x = [i];
+    return function f() { return x; }
+}
+
+function test()
+{
+    var N = internalConst("INCREMENTAL_MARK_STACK_BASE_CAPACITY") + 2;
+    var o = {};
+    var descriptor = { enumerable: true};
+    for (var i = 0; i != N; ++i) {
+	descriptor.get = build_getter(i);
+	Object.defineProperty(o, i, descriptor);
+    }
+
+    // At this point we have an object o with N getters. Each getter in turn
+    // is a closure storing an array. During the GC we push to the object
+    // marking stack all the getters found in an object after we mark it. As N
+    // exceeds the size of the object marking stack, this requires to run the
+    // dealyed scanning for some closures to mark the array objects stored in
+    // them.
+    //
+    // We run the GC twice to make sure that the background finalization
+    // finishes before we access the objects.
+    gc();
+    gc();
+    for (var i = 0; i != N; ++i)
+	assertEq(o[i][0], i);
+}
+
+test();