1 files changed, 10 insertions, 0 deletions
diff --git a/js/src/jit-test/tests/auto-regress/bug648839.js b/js/src/jit-test/tests/auto-regress/bug648839.js
new file mode 100644
index 0000000000..43908bad76
--- /dev/null
+++ b/js/src/jit-test/tests/auto-regress/bug648839.js
@@ -0,0 +1,10 @@
+// Binary: cache/js-dbg-64-d3215d1e985a-linux
+// Flags: -m -n -a
+//
+ForIn_1( { length:4, company:"netscape", year:2000, 0:"zero" } );
+function ForIn_1( object ) {
+  PropertyArray = new Array();
+  for ( PropertyArray[PropertyArray.length] in object ) {
+      object[1];
+  }
+}