1 files changed, 15 insertions, 0 deletions
diff --git a/js/src/jit-test/tests/basic/testGlobalShapeChangeAfterDeepBail.js b/js/src/jit-test/tests/basic/testGlobalShapeChangeAfterDeepBail.js
new file mode 100644
index 0000000000..0839b370c3
--- /dev/null
+++ b/js/src/jit-test/tests/basic/testGlobalShapeChangeAfterDeepBail.js
@@ -0,0 +1,15 @@
+// Complicated whitebox test for bug 487845.
+function testGlobalShapeChangeAfterDeepBail() {
+    function f(name) {
+        this[name] = 1;  // may change global shape
+        for (var i = 0; i < 4; i++)
+            ; // MonitorLoopEdge eventually triggers assertion
+    }
+
+    // When i==3, deep-bail, then change global shape enough times to exhaust
+    // the array of GlobalStates.
+    var arr = [[], [], [], ["bug0", "bug1", "bug2", "bug3", "bug4"]];
+    for (var i = 0; i < arr.length; i++)
+        arr[i].forEach(f);
+}
+testGlobalShapeChangeAfterDeepBail();