diff -r 000000000000 -r 6474c204b198 js/src/jit-test/tests/basic/bug535474.js
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/js/src/jit-test/tests/basic/bug535474.js	Wed Dec 31 06:09:35 2014 +0100
@@ -0,0 +1,27 @@
+function f() {
+  var _76 = {};
+  for (var i = 0; i < arguments.length; i++) {
+    var typ = arguments[i];
+    _76[typ] = typ;
+  }
+  return function () {
+    for (var i = 0; i < arguments.length; i++) {
+      if (!(typeof (arguments[i]) in _76)) {
+        return false;
+      }
+    }
+    return true;
+  }
+}
+
+g = f("number", "boolean", "object");
+
+g("a", "b", "c", "d", "e", "f", 2);
+g(2, "a", "b", "c", "d", "e", "f", 2);
+
+/*
+ * Don't assert --
+ * Assertion failed: frame entry -4 wasn't freed
+ * : _activation.entry[i] == 0 (../nanojit/Assembler.cpp:786)
+ */
+