From 5f8de423f190bbb79a62f804151bc24824fa32d8 Mon Sep 17 00:00:00 2001
From: "Matt A. Tobin" <mattatobin@localhost.localdomain>
Date: Fri, 2 Feb 2018 04:16:08 -0500
Subject: Add m-esr52 at 52.6.0

---
 js/src/jit-test/tests/ion/instanceof-mutate-proto.js | 13 +++++++++++++
 1 file changed, 13 insertions(+)
 create mode 100644 js/src/jit-test/tests/ion/instanceof-mutate-proto.js

(limited to 'js/src/jit-test/tests/ion/instanceof-mutate-proto.js')

diff --git a/js/src/jit-test/tests/ion/instanceof-mutate-proto.js b/js/src/jit-test/tests/ion/instanceof-mutate-proto.js
new file mode 100644
index 000000000..e3e057ec4
--- /dev/null
+++ b/js/src/jit-test/tests/ion/instanceof-mutate-proto.js
@@ -0,0 +1,13 @@
+function g(i) {
+    with(this) {}; // Don't inline.
+    if (i === 1500)
+	String.prototype.__proto__ = Array.prototype;
+}
+function f() {
+    var arr = new String("A");
+    for (var i=0; i<2000; i++) {
+	g(i);
+	assertEq(arr instanceof Array, i >= 1500);
+    }
+}
+f();
-- 
cgit v1.2.3