1 files changed, 32 insertions, 0 deletions
diff --git a/js/src/jit-test/tests/warp/bug1700616.js b/js/src/jit-test/tests/warp/bug1700616.js
new file mode 100644
index 0000000000..9bdd83c474
--- /dev/null
+++ b/js/src/jit-test/tests/warp/bug1700616.js
@@ -0,0 +1,32 @@
+function dummy() { with ({}) {}}
+
+function foo() {
+    var a = 0;
+    var b = 1;
+    var c = 2;
+    var d = 3;
+
+    // This call will run before we enter jitcode and won't have IC
+    // data, so branch pruning will remove the path from the entry
+    // block to the OSR preheader.
+    dummy();
+
+    // We will OSR in this loop. Because there's no path from the
+    // function entry to the loop, the only information we have
+    // about a, b, c, and d is that they come from the OSR block.
+    for (var i = 0; i < 1000; i++) {
+
+        // Create a bunch of phis that only depend on OsrValues.
+        // These phis will be specialized to MIRType::Value.
+        a = i % 2 ? b : c;
+        b = i % 3 ? c : d;
+        c = i % 4 ? d : a;
+        d = i % 5 ? a : b;
+
+        // This phi will be optimistically specialized to
+        // MIRType::String and trigger a bailout.
+        dummy(i % 6 ? d : "");
+    }
+    return a;
+}
+foo();