1 files changed, 31 insertions, 0 deletions
diff --git a/js/src/jit-test/tests/basic/testGuardCalleeSneakAttack.js b/js/src/jit-test/tests/basic/testGuardCalleeSneakAttack.js
new file mode 100644
index 000000000..87939ef99
--- /dev/null
+++ b/js/src/jit-test/tests/basic/testGuardCalleeSneakAttack.js
@@ -0,0 +1,31 @@
+function loop(f, expected) {
+   // This is the loop that breaks us.
+   // At record time, f's parent is a Call object with no fp.
+   // At second execute time, it is a Call object with fp,
+   // and all the Call object's dslots are still JSVAL_VOID.
+   for (var i = 0; i < 9; i++)
+       assertEq(f(), expected);
+}
+
+function C(bad) {
+   var x = bad;
+   function f() {
+       return x;  // We trick TR::callProp() into emitting code that gets
+                  // JSVAL_VOID (from the Call object's dslots)
+                  // rather than the actual value (true or false).
+   }
+   this.m = f;
+   return f;
+}
+
+var obj = {
+   set m(f) {
+       if (f())  // Call once to resolve x on the Call object,
+                 // for shape consistency. Otherwise loop gets
+                 // recorded twice.
+           loop(f, true);
+   }
+};
+
+loop(C.call(obj, false), false);
+C.call(obj, true);