diff -r 000000000000 -r 6474c204b198 js/src/jit-test/tests/ion/bug836705.js
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/js/src/jit-test/tests/ion/bug836705.js	Wed Dec 31 06:09:35 2014 +0100
@@ -0,0 +1,12 @@
+
+Object.prototype[3] = 3;
+var sjcl = {
+    cipher: {},
+};
+sjcl.cipher.aes = function (a) {
+    d = a.slice(0);
+    for (a=0; a < 60; a++) {
+        c = d[a - 1];
+    }
+};
+new sjcl.cipher.aes([0xffffffff, 0xffffffff]);