1 files changed, 32 insertions, 0 deletions
diff --git a/js/src/jit-test/tests/arguments/inline-arguments-oob-negative-index-2.js b/js/src/jit-test/tests/arguments/inline-arguments-oob-negative-index-2.js
new file mode 100644
index 0000000000..e5c9f0cd6e
--- /dev/null
+++ b/js/src/jit-test/tests/arguments/inline-arguments-oob-negative-index-2.js
@@ -0,0 +1,32 @@
+// |jit-test| --fast-warmup
+
+function inner(i) {
+  // Can't be eliminated because negative indices cause a bailout.
+  arguments[i];
+  arguments[i];
+  arguments[i];
+}
+
+function outer(i) {
+  trialInline();
+
+  // Loop header to trigger OSR.
+  for (let j = 0; j < 1; ++j) {
+    inner(i);
+  }
+}
+
+let count = 0;
+
+for (let i = 0; i <= 100; ++i) {
+    if (i === 50) {
+      Object.defineProperty(Object.prototype, -1, {
+        get() {
+          count++;
+        }
+      });
+    }
+    outer(i < 100 ? i : -1);
+}
+
+assertEq(count, 3);