1 files changed, 18 insertions, 0 deletions
diff --git a/js/src/jit-test/tests/ion/bug1282944.js b/js/src/jit-test/tests/ion/bug1282944.js
new file mode 100644
index 0000000000..e59b659e1e
--- /dev/null
+++ b/js/src/jit-test/tests/ion/bug1282944.js
@@ -0,0 +1,18 @@
+// |jit-test| --ion-eager; skip-if: helperThreadCount() === 0
+
+// (1) Poison an element in the ionLazyLinkList with a builder whose
+//     script is in a different compartment.
+evaluate(`
+offThreadCompileToStencil("var x = -1");
+var stencil = finishOffThreadStencil();
+evalStencil(stencil);
+`,
+         { global: newGlobal() });
+
+// (2) Spam the ionLazyLinkList with pending builders until it pops off the one
+//     for the other compartment's script.
+for (var i = 0; i < 1000; ++i) {
+  offThreadCompileToStencil('var x = ' + i);
+  var stencil = finishOffThreadStencil();
+  evalStencil(stencil);
+}