src/third_party/mozjs-45/js/src/jit-test/tests/ion/bug1028910.js

setJitCompilerOption("ion.warmup.trigger", 4);

var IsObject = getSelfHostedValue("IsObject")
function test(foo) {
    if (IsObject(foo)) {
        print(foo.test)
    }

}

for (var i=0; i<10; i++) {
  test(1)
  test({})
}