1 files changed, 18 insertions, 0 deletions
diff --git a/js/src/jit-test/tests/ion/bug1057598.js b/js/src/jit-test/tests/ion/bug1057598.js
new file mode 100644
index 0000000000..63c1bf01b2
--- /dev/null
+++ b/js/src/jit-test/tests/ion/bug1057598.js
@@ -0,0 +1,18 @@
+// enableShellAllocationMetadataBuilder ignores its argument, because we don't
+// permit metadata callbacks to run JS any more, so this test may be
+// unnecessary. We'll preserve its structure just in case.
+enableShellAllocationMetadataBuilder(function( r, ... d)  {});
+setJitCompilerOption("ion.warmup.trigger", 20);
+var uceFault = function (i) {
+    if (i > 98)
+        uceFault = function (i) { return true; };
+}
+var uceFault_str_split = eval(`(${uceFault})`.replace('uceFault', 'uceFault_str_split'))
+function rstr_split(i) {
+    var x = "str01234567899876543210rts".split("" + i);
+    if (uceFault_str_split(i) || uceFault_str_split(i)) {
+    }
+}
+for (i = 0; i < 100; i++) {
+    rstr_split(i);
+}