1 files changed, 32 insertions, 0 deletions
diff --git a/js/src/jit-test/tests/basic/testGuardCalleeSneakAttack2.js b/js/src/jit-test/tests/basic/testGuardCalleeSneakAttack2.js
new file mode 100644
index 0000000000..9bf3c0c383
--- /dev/null
+++ b/js/src/jit-test/tests/basic/testGuardCalleeSneakAttack2.js
@@ -0,0 +1,32 @@
+function loop(f, expected) {
+   // This is the loop that breaks us.
+   // At record time, f's parent is a Call object with no fp.
+   // At second execute time, it is a Call object with fp,
+   // and all the Call object's dslots are still JSVAL_VOID.
+   for (var i = 0; i < 9; i++)
+       assertEq(f(), expected);
+}
+
+function C(bad) {
+   var x = bad;
+   function f() {
+       return x;  // We trick TR::callProp() into emitting code that gets
+                  // JSVAL_VOID (from the Call object's dslots)
+                  // rather than the actual value (true or false).
+   }
+   if (bad)
+       void (f + "a!");
+   return f;
+}
+
+var obj = {
+};
+
+// Warm up and trace with C's Call object entrained but its stack frame gone.
+loop(C.call(obj, false), false);
+
+// Sneaky access to f via a prototype method called implicitly by operator +.
+Function.prototype.toString = function () { loop(this, true); return "hah"; };
+
+// Fail hard if we don't handle the implicit call out of C to F.p.toString.
+C.call(obj, true);