1 files changed, 9 insertions, 0 deletions
diff --git a/js/src/jit-test/tests/ion/bug906035.js b/js/src/jit-test/tests/ion/bug906035.js
new file mode 100644
index 000000000..09d0af7d6
--- /dev/null
+++ b/js/src/jit-test/tests/ion/bug906035.js
@@ -0,0 +1,9 @@
+// |jit-test| --ion-eager
+function y() { return "foo,bar"; }
+function x() {
+  var z = y().split(',');
+  for (var i = 0; i < z.length; i++) {}
+}
+gczeal(2);
+Object.prototype.length = function () {};
+x();