1 files changed, 24 insertions, 0 deletions
diff --git a/js/src/jit-test/tests/cacheir/bug1651732-proxy-has.js b/js/src/jit-test/tests/cacheir/bug1651732-proxy-has.js
new file mode 100644
index 0000000000..004b5982d8
--- /dev/null
+++ b/js/src/jit-test/tests/cacheir/bug1651732-proxy-has.js
@@ -0,0 +1,24 @@
+// An object with a custom [Symbol.toPrimitive] function.
+var key = {
+  value: "a",
+
+  [Symbol.toPrimitive]() {
+    return this.value;
+  }
+};
+
+var target = {
+  a: 0,
+  [Symbol.iterator]: 0,
+};
+var obj = new Proxy(target, {});
+
+for (var i = 0; i < 100; ++i) {
+  // Change key[Symbol.toPrimitive] to return a symbol after some warm-up.
+  if (i > 80) {
+    key.value = Symbol.iterator;
+  }
+
+  // Attach an IC for JSOp::In on proxies.
+  assertEq(key in obj, true);
+}