diff -r 000000000000 -r 6474c204b198 js/src/jit-test/tests/jaeger/testSetElem-NewProto.js
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/js/src/jit-test/tests/jaeger/testSetElem-NewProto.js	Wed Dec 31 06:09:35 2014 +0100
@@ -0,0 +1,24 @@
+// vim: set ts=8 sts=4 et sw=4 tw=99:
+
+function f() {
+    return [[], [], [], []];
+}
+
+function setelem(obj, key, val) {
+    obj[key] = val;
+}
+
+// Generate IC
+setelem([], 0, "hi");
+setelem([], 0, "hi");
+
+var arrays = f();
+
+var evil = { };
+Object.defineProperty(evil, "1", { set: function (v) { this.ham = v; } });
+Array.prototype.__proto__ = evil;
+
+var k = arrays[0];
+setelem(k, 1, "yam");
+assertEq(k.ham, "yam");
+