1 files changed, 37 insertions, 0 deletions
diff --git a/js/src/jit-test/tests/ion/bug1497107.js b/js/src/jit-test/tests/ion/bug1497107.js
new file mode 100644
index 0000000000..c3c4942f88
--- /dev/null
+++ b/js/src/jit-test/tests/ion/bug1497107.js
@@ -0,0 +1,37 @@
+function makeChain(n, base) {
+    var curr = base;
+    for (var i = 0; i < n; i++) {
+	curr = Object.create(curr);
+	var propname = "level" + i;
+	curr[propname] = true;
+    }
+    return curr;
+}
+
+function BaseClass() {
+    this.base = true;
+}
+
+Object.defineProperty(BaseClass.prototype, "getter", {get: function() { with({}){}; return this.base; }});
+
+function victim(arg) {
+    if (arg.getter) {
+	return 3;
+    } else {
+	return 4;
+    }
+}
+
+let root = new BaseClass();
+let chains = [];
+for (var i = 0; i < 6; i++) {
+    chains.push(makeChain(500, root));
+}
+
+with({}){};
+for (var i = 0; i < 1000 / 6; i++) {
+    with({}){};
+    for (var j = 0; j < chains.length; j++) {
+	victim(chains[j]);
+    }
+}