diff --git a/unittests/ASM/FEX_bugs/fpatan_PopStackTag.asm b/unittests/ASM/FEX_bugs/fpatan_PopStackTag.asm
new file mode 100644
index 000000000..a327d0b8d
--- /dev/null
+++ b/unittests/ASM/FEX_bugs/fpatan_PopStackTag.asm
@@ -0,0 +1,33 @@
+%ifdef CONFIG
+{
+  "RegData": {
+    "RAX": "0x80"
+  }
+}
+%endif
+
+; FEX had a bug in the slow path of x87 stack-optimization pass:
+; popping the FPU stack never invalidated ST(0)
+;
+; Note this test only actually exercises the bug under the jit_1 run
+; since otherwise the fast path is taken
+
+fninit
+
+fld1
+fldl2e
+
+fpatan
+
+fxsave [rel .data]
+
+; FTW
+; Bit 6 (popped value) must be 0 now
+; Bit 7 (result) must be 1
+movzx eax, byte [rel .data + 4]
+
+hlt
+
+align 16
+.data:
+times 64 dq 0
diff --git a/unittests/ASM/FEX_bugs/fyl2x_PopStackTag.asm b/unittests/ASM/FEX_bugs/fyl2x_PopStackTag.asm
new file mode 100644
index 000000000..40a55eec0
--- /dev/null
+++ b/unittests/ASM/FEX_bugs/fyl2x_PopStackTag.asm
@@ -0,0 +1,33 @@
+%ifdef CONFIG
+{
+  "RegData": {
+    "RAX": "0x80"
+  }
+}
+%endif
+
+; FEX had a bug in the slow path of x87 stack-optimization pass:
+; popping the FPU stack never invalidated ST(0)
+;
+; Note this test only actually exercises the bug under the jit_1 run
+; since otherwise the fast path is taken
+
+fninit
+
+fld1
+fld1
+
+fyl2x
+
+fxsave [rel .data]
+
+; FTW
+; Bit 6 (popped value) must be 0 now
+; Bit 7 (result) must be 1
+movzx eax, byte [rel .data + 4]
+
+hlt
+
+align 16
+.data:
+times 64 dq 0