diff -r 000000000000 -r 6474c204b198 js/src/jit-test/tests/auto-regress/bug648839.js
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/js/src/jit-test/tests/auto-regress/bug648839.js	Wed Dec 31 06:09:35 2014 +0100
@@ -0,0 +1,10 @@
+// Binary: cache/js-dbg-64-d3215d1e985a-linux
+// Flags: -m -n -a
+//
+ForIn_1( { length:4, company:"netscape", year:2000, 0:"zero" } );
+function ForIn_1( object ) {
+  PropertyArray = new Array();
+  for ( PropertyArray[PropertyArray.length] in object ) {
+      object[1];
+  }
+}