diff -r 000000000000 -r 6474c204b198 js/src/jit-test/tests/jaeger/bug617558.js
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/js/src/jit-test/tests/jaeger/bug617558.js	Wed Dec 31 06:09:35 2014 +0100
@@ -0,0 +1,7 @@
+
+Array.prototype.__proto__ = Function.prototype;
+var x = [1,2,3];
+x[0];
+
+[].__proto__.foo = true;
+eval("[]");