1 files changed, 17 insertions, 0 deletions
diff --git a/js/src/jit-test/tests/auto-regress/bug666599.js b/js/src/jit-test/tests/auto-regress/bug666599.js
new file mode 100644
index 000000000..7b0740bf0
--- /dev/null
+++ b/js/src/jit-test/tests/auto-regress/bug666599.js
@@ -0,0 +1,17 @@
+// |jit-test| error:TypeError
+
+// Binary: cache/js-dbg-32-0428dbdf3d58-linux
+// Flags:
+//
+o1 = new Float32Array().buffer
+o2 = ArrayBuffer.prototype
+o3 = new Uint32Array().buffer
+for (i = 0; i < 2; i++) {
+    for (var x in o2) {
+        o3.__defineGetter__("", function() {})
+    }
+    o2.__defineGetter__("", function() {})
+    o1[
+    x]
+    o1.__proto__ = o3
+}