1 files changed, 17 insertions, 0 deletions
diff --git a/js/src/jit-test/tests/auto-regress/bug658803.js b/js/src/jit-test/tests/auto-regress/bug658803.js
new file mode 100644
index 0000000000..95b1a5bba7
--- /dev/null
+++ b/js/src/jit-test/tests/auto-regress/bug658803.js
@@ -0,0 +1,17 @@
+// Binary: cache/js-dbg-32-33f1ad45ccb8-linux
+// Flags: -m -n
+//
+function f() {
+  var N = 624;
+  this.init_genrand = function(s) {
+    for (z = 1; z < N; z++) {}
+  };
+}(function() {
+  new f;
+}());
+function g(o) {
+  var props = Object.getOwnPropertyNames(o);
+  var prop = props[props.length - 1] + "p"
+  o[prop] = Number.prototype.__proto__;
+}
+g(Number.prototype.__proto__);