1 files changed, 29 insertions, 0 deletions
diff --git a/js/src/jit-test/tests/auto-regress/bug488015.js b/js/src/jit-test/tests/auto-regress/bug488015.js
new file mode 100644
index 000000000..5d19c2b95
--- /dev/null
+++ b/js/src/jit-test/tests/auto-regress/bug488015.js
@@ -0,0 +1,29 @@
+// Binary: cache/js-dbg-64-e1257570fef8-linux
+// Flags:
+//
+var a = [];
+function addEventListener(e, f, g)
+{
+  a.push(f);
+}
+function setTimeout(f, t)
+{
+  a.push(f);
+}
+var b;
+this.document = {};
+function e(w) {
+  addEventListener("mousedown", d, true);
+  function d() {
+    var d;
+    w.setTimeout(function() {
+        b(d);
+      }, 0);
+  }
+  function b(d){
+    w.document;  /* Crash Here!! */
+  }
+}
+e(this);
+a[0]();
+a[1]();