diff -r 000000000000 -r 6474c204b198 js/src/jit-test/tests/ion/invalidation/outofline.js
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/js/src/jit-test/tests/ion/invalidation/outofline.js	Wed Dec 31 06:09:35 2014 +0100
@@ -0,0 +1,22 @@
+// Breaks with --ion -n. See bug 718122.
+
+function Foo()
+{ }
+
+Foo.prototype.bar = function(){
+	print("yes hello");
+	return 5;
+}
+
+var x = new Foo();
+
+function f(x) {
+	// Enter Ion.
+	for (var i=0; i < 41; i++);
+
+	// At this point we have no type information for the GetPropertyCache below.
+	// This causes the cache to be typed as Value.
+	x.bar();
+}
+
+f(x);