1 files changed, 12 insertions, 0 deletions
diff --git a/js/src/jit-test/tests/ion/bug836705.js b/js/src/jit-test/tests/ion/bug836705.js
new file mode 100644
index 0000000000..aa13c082e1
--- /dev/null
+++ b/js/src/jit-test/tests/ion/bug836705.js
@@ -0,0 +1,12 @@
+
+Object.prototype[3] = 3;
+var sjcl = {
+    cipher: {},
+};
+sjcl.cipher.aes = function (a) {
+    d = a.slice(0);
+    for (a=0; a < 60; a++) {
+        c = d[a - 1];
+    }
+};
+new sjcl.cipher.aes([0xffffffff, 0xffffffff]);