1 files changed, 18 insertions, 0 deletions
diff --git a/js/src/jit-test/tests/ion/bug1006899.js b/js/src/jit-test/tests/ion/bug1006899.js
new file mode 100644
index 000000000..149d30f28
--- /dev/null
+++ b/js/src/jit-test/tests/ion/bug1006899.js
@@ -0,0 +1,18 @@
+if (!this.hasOwnProperty("TypedObject"))
+  quit();
+
+this.__defineGetter__("x",
+  function() {
+    return this;
+  }
+);
+function callback(obj) {}
+enableShellAllocationMetadataBuilder();
+evaluate("\
+var { ArrayType, StructType, uint32 } = TypedObject;\
+  var L = 1024;\
+  var Matrix = uint32.array(L, 2);\
+  var matrix = new Matrix();\
+  for (var i = 0; i < L; i++)\
+    matrix[i][0] = x;\
+", { isRunOnce : true });