1 files changed, 23 insertions, 0 deletions
diff --git a/js/src/jit-test/tests/cacheir/bug1651732-proxy-set.js b/js/src/jit-test/tests/cacheir/bug1651732-proxy-set.js
new file mode 100644
index 0000000000..a52362a91f
--- /dev/null
+++ b/js/src/jit-test/tests/cacheir/bug1651732-proxy-set.js
@@ -0,0 +1,23 @@
+// An object with a custom [Symbol.toPrimitive] function.
+var key = {
+  value: "a",
+
+  [Symbol.toPrimitive]() {
+    return this.value;
+  }
+};
+
+var target = {};
+var obj = new Proxy(target, {});
+
+for (var i = 0; i < 100; ++i) {
+  // Change key[Symbol.toPrimitive] to return a symbol after some warm-up.
+  if (i > 80) {
+    key.value = Symbol.iterator;
+  }
+
+  obj[key] = i;
+
+  // Attach an IC for JSOp::SetElem on proxies.
+  assertEq(target[key.value], i);
+}