1 files changed, 16 insertions, 0 deletions
diff --git a/js/src/jit-test/tests/auto-regress/bug648992.js b/js/src/jit-test/tests/auto-regress/bug648992.js
new file mode 100644
index 000000000..b96d4b309
--- /dev/null
+++ b/js/src/jit-test/tests/auto-regress/bug648992.js
@@ -0,0 +1,16 @@
+// Binary: cache/js-dbg-32-74a8fb1bbec5-linux
+// Flags: -m -n -a
+//
+o0 = (3).__proto__
+function f(o) {
+    var prop
+    [o][0][prop] = []
+    try {
+        ({
+            x: function() {
+                return o
+            }
+        }.x()())
+    } catch (e) {}
+}
+f(o0)