1 files changed, 21 insertions, 0 deletions
diff --git a/js/src/jit-test/tests/auto-regress/bug638212.js b/js/src/jit-test/tests/auto-regress/bug638212.js
new file mode 100644
index 0000000000..4def4ca336
--- /dev/null
+++ b/js/src/jit-test/tests/auto-regress/bug638212.js
@@ -0,0 +1,21 @@
+// Binary: cache/js-dbg-64-01037ab16a65-linux
+// Flags: -j -m -a
+//
+o2 = this;
+function f0(o) { }
+function f4(o) { }
+(function() {
+Object.seal(o2);
+})();
+function f3(o) { }
+function f7(o) {
+var _var_ = o;
+--(_var_["-1"]);
+}
+for(var i1=0; i1<6; i1++) {
+f4(f3);
+f4 = new Proxy(f7, {});
+}
+f4(f0);
+
+try { eval("var __proto__"); } catch(exc1) {}