1 files changed, 17 insertions, 0 deletions
diff --git a/js/src/jit-test/tests/ion/bug1527148.js b/js/src/jit-test/tests/ion/bug1527148.js
new file mode 100644
index 0000000000..509dbb90b5
--- /dev/null
+++ b/js/src/jit-test/tests/ion/bug1527148.js
@@ -0,0 +1,17 @@
+var log = "";
+function g() {
+    var x = [];
+    for (var k = 0; k < 2; ++k) {
+        x.push(k);
+    }
+    log += x;
+}
+for (var i = 0; i < 1; i++) {
+    f = function() {};
+}
+g();
+Array.prototype.push = f;
+g();
+f.__proto__ = [];
+g();
+assertEq(log, "0,1");