| Index: test/mjsunit/regress/regress-670808.js | 
| diff --git a/test/mjsunit/regress/regress-670808.js b/test/mjsunit/regress/regress-670808.js | 
| new file mode 100644 | 
| index 0000000000000000000000000000000000000000..d5e0b51be6aec5f49e0cd35d18f3dee7260e8d4f | 
| --- /dev/null | 
| +++ b/test/mjsunit/regress/regress-670808.js | 
| @@ -0,0 +1,22 @@ | 
| +// Copyright 2016 the V8 project authors. All rights reserved. | 
| +// Use of this source code is governed by a BSD-style license that can be | 
| +// found in the LICENSE file. | 
| + | 
| +var sym = Symbol(); | 
| +function asm(stdlib, ffi) { | 
| +  "use asm"; | 
| +  var get_sym = ffi.get_sym; | 
| +  function crash() { | 
| +    get_sym()|0; | 
| +  } | 
| +  return {crash: crash}; | 
| +} | 
| +function get_sym() { | 
| +  return sym; | 
| +} | 
| +try { | 
| +  asm(null, {get_sym: get_sym}).crash(); | 
| +} catch (e) { | 
| +  if (!(e instanceof TypeError)) | 
| +    throw e; | 
| +} | 
|  |