1 files changed, 17 insertions, 0 deletions
diff --git a/js/src/jit-test/tests/ion/bug944080.js b/js/src/jit-test/tests/ion/bug944080.js
new file mode 100644
index 0000000000..3f6889ce0b
--- /dev/null
+++ b/js/src/jit-test/tests/ion/bug944080.js
@@ -0,0 +1,17 @@
+
+function intLength (a, l) {
+    var res = 0;
+    for (var i = 0; i < l; i++)
+	res += a.length;
+}
+intLength([0,1,2,3,4,5,6,7,8,9], 10)
+intLength(new Uint8Array(10), 10)
+function test() {
+    var a = "abc".split("");
+    var res = 0;
+    for (var i=0; i<20; i++)
+	res += a.length;
+    return res;
+}
+Object.prototype.length = function(){};
+assertEq(test(), 60);