1 files changed, 13 insertions, 0 deletions
diff --git a/js/src/jit-test/tests/ion/instanceof-mutate-proto.js b/js/src/jit-test/tests/ion/instanceof-mutate-proto.js
new file mode 100644
index 0000000000..e3e057ec4f
--- /dev/null
+++ b/js/src/jit-test/tests/ion/instanceof-mutate-proto.js
@@ -0,0 +1,13 @@
+function g(i) {
+    with(this) {}; // Don't inline.
+    if (i === 1500)
+	String.prototype.__proto__ = Array.prototype;
+}
+function f() {
+    var arr = new String("A");
+    for (var i=0; i<2000; i++) {
+	g(i);
+	assertEq(arr instanceof Array, i >= 1500);
+    }
+}
+f();