1 files changed, 20 insertions, 0 deletions
diff --git a/js/src/jit-test/tests/promise/species-redefine-getter.js b/js/src/jit-test/tests/promise/species-redefine-getter.js
new file mode 100644
index 0000000000..4e30759cf2
--- /dev/null
+++ b/js/src/jit-test/tests/promise/species-redefine-getter.js
@@ -0,0 +1,20 @@
+// Ensure the HadGetterSetterChange flag is set.
+Object.defineProperty(Promise, "foo", {configurable: true, get: function() {}});
+Object.defineProperty(Promise, "foo", {configurable: true, get: function() {}});
+
+// Initialize PromiseLookup.
+var p = new Promise(() => {});
+for (let i = 0; i < 5; i++) {
+    Promise.all([p]);
+}
+
+// Redefine the Promise[Symbol.species] getter without changing its attributes/shape.
+let count = 0;
+Object.defineProperty(Promise, Symbol.species,
+                      {get: function() { count++; }, enumerable: false, configurable: true});
+
+// Ensure PromiseLookup now deoptimizes and calls the getter.
+for (let i = 0; i < 5; i++) {
+    Promise.all([p]);
+}
+assertEq(count, 5);