1 files changed, 27 insertions, 0 deletions
diff --git a/js/src/jit-test/tests/asm.js/testBug1164391.js b/js/src/jit-test/tests/asm.js/testBug1164391.js
new file mode 100644
index 000000000..80ec8659c
--- /dev/null
+++ b/js/src/jit-test/tests/asm.js/testBug1164391.js
@@ -0,0 +1,27 @@
+if (!this.SharedArrayBuffer || !isAsmJSCompilationAvailable())
+    quit(0);
+
+load(libdir + "asm.js");
+load(libdir + "asserts.js");
+setJitCompilerOption('asmjs.atomics.enable', 1);
+
+var m = asmCompile("stdlib", "ffi", "heap", `
+    "use asm";
+    var HEAP32 = new stdlib.Int32Array(heap);
+    var add = stdlib.Atomics.add;
+    var load = stdlib.Atomics.load;
+    function add_sharedEv(i1) {
+        i1 = i1 | 0;
+        load(HEAP32, i1 >> 2);
+        add(HEAP32, i1 >> 2, 1);
+        load(HEAP32, i1 >> 2);
+    }
+    return {add_sharedEv:add_sharedEv};
+`);
+
+if (isAsmJSCompilationAvailable())
+    assertEq(isAsmJSModule(m), true);
+
+var sab = new SharedArrayBuffer(65536);
+var {add_sharedEv} = m(this, {}, sab);
+assertErrorMessage(() => add_sharedEv(sab.byteLength), WebAssembly.RuntimeError, /index out of bounds/);