1 files changed, 14 insertions, 0 deletions
diff --git a/js/src/jit-test/tests/basic/bug1135718.js b/js/src/jit-test/tests/basic/bug1135718.js
new file mode 100644
index 0000000000..515457cdfb
--- /dev/null
+++ b/js/src/jit-test/tests/basic/bug1135718.js
@@ -0,0 +1,14 @@
+
+setJitCompilerOption("ion.warmup.trigger", 30);
+function ArrayCallback(state) {
+  return this.state = state;
+}
+ArrayCallback.prototype.isUpperCase = function(v, index, array) {
+    return this.state ? true : (v == v.toUpperCase());
+};
+strings = ['hello', 'Array', 'WORLD'];
+obj = new ArrayCallback(false);
+strings.filter(obj.isUpperCase, obj)
+obj = new ArrayCallback(true);
+strings.filter(obj.isUpperCase, obj)
+obj.__proto__ = {};