1 files changed, 42 insertions, 0 deletions
diff --git a/js/src/jit-test/tests/cacheir/bug1852893-2.js b/js/src/jit-test/tests/cacheir/bug1852893-2.js
new file mode 100644
index 0000000000..daf1d2d8b9
--- /dev/null
+++ b/js/src/jit-test/tests/cacheir/bug1852893-2.js
@@ -0,0 +1,42 @@
+// |jit-test| --fast-warmup; --no-threads; --blinterp-eager
+
+function foo(o) {
+  return foo_inner(o);
+}
+
+function foo_inner(o) {
+  return o.x;
+}
+
+function bar(n) {
+  with ({}) {}
+  class C {}
+  for (var i = 0; i < n; i++) {
+    var c = new C();
+    c.x = 0;
+    foo(c);
+  }
+}
+
+with ({}) {}
+
+function triggerIonCompile() {
+  for (var i = 0; i < 10; i++) {
+    bar(3);
+  }
+}
+
+triggerIonCompile();
+
+// Fill up shape list
+for (var i = 0; i < 6; i++) {
+  bar(10);
+}
+
+// Overflow shape list, adding a new baseline IC.
+bar(10);
+
+// Purge a stub inside a monomorphically-inlined script.
+gc();
+
+triggerIonCompile();