diff -r 000000000000 -r 6474c204b198 js/src/jit-test/tests/basic/bug504587-1.js
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/js/src/jit-test/tests/basic/bug504587-1.js	Wed Dec 31 06:09:35 2014 +0100
@@ -0,0 +1,13 @@
+// This test case failed a WIP patch. See https://bugzilla.mozilla.org/show_bug.cgi?id=504587#c68
+
+function B() {}
+B.prototype.x = 1;
+var d = new B;
+
+var names = ['z', 'z', 'z', 'z', 'z', 'z', 'z', 'x'];
+for (var i = 0; i < names.length; i++) {
+    x = d.x;  // guard on shapeOf(d)
+    d[names[i]] = 2;  // unpredicted shape change
+    y = d.x;  // guard here is elided
+}
+assertEq(y, 2);  // Assertion failed: got 1, expected 2