diff -r 000000000000 -r 6474c204b198 js/src/tests/js1_8_5/regress/regress-554955-4.js
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/js/src/tests/js1_8_5/regress/regress-554955-4.js	Wed Dec 31 06:09:35 2014 +0100
@@ -0,0 +1,36 @@
+/* -*- Mode: C++; tab-width: 4; indent-tabs-mode: nil; c-basic-offset: 4 -*- */
+/*
+ * Any copyright is dedicated to the Public Domain.
+ * http://creativecommons.org/licenses/publicdomain/
+ */
+
+function f() {
+    return function(a) {
+        // This eval must take place before the block is cloned, when the
+        // call object is still not marked as a delegate. The scope chain
+        // purge for the JSOP_DEFVAR will not change the global's shape,
+        // and the property cache entry will remain valid.
+        eval(a);
+        let (c = 3) {
+            // This eval forces the block to be cloned, so its shape gets
+            // used as the property cache key shape.
+            eval('');
+            return b;
+        };
+    };
+}
+
+var b = 1;
+var g1 = f();
+var g2 = f();
+
+/* Call the lambda once, caching a reference to the global b. */
+g1('');
+
+/*
+ * If this call sees the above cache entry, then it will erroneously use the
+ * global b.
+ */
+assertEq(g2('var b=2'), 2);
+
+reportCompare(true, true);