1 files changed, 24 insertions, 0 deletions
diff --git a/js/src/jit-test/tests/jaeger/testSetElem-NewProto.js b/js/src/jit-test/tests/jaeger/testSetElem-NewProto.js
new file mode 100644
index 0000000000..f202513d53
--- /dev/null
+++ b/js/src/jit-test/tests/jaeger/testSetElem-NewProto.js
@@ -0,0 +1,24 @@
+// vim: set ts=8 sts=4 et sw=4 tw=99:
+
+function f() {
+    return [[], [], [], []];
+}
+
+function setelem(obj, key, val) {
+    obj[key] = val;
+}
+
+// Generate IC
+setelem([], 0, "hi");
+setelem([], 0, "hi");
+
+var arrays = f();
+
+var evil = { };
+Object.defineProperty(evil, "1", { set: function (v) { this.ham = v; } });
+Array.prototype.__proto__ = evil;
+
+var k = arrays[0];
+setelem(k, 1, "yam");
+assertEq(k.ham, "yam");
+