1 files changed, 10 insertions, 0 deletions
diff --git a/js/src/jit-test/tests/arrays/too-long-array-splice.js b/js/src/jit-test/tests/arrays/too-long-array-splice.js
new file mode 100644
index 0000000000..d691cc929f
--- /dev/null
+++ b/js/src/jit-test/tests/arrays/too-long-array-splice.js
@@ -0,0 +1,10 @@
+// |jit-test| allow-oom
+// array.splice should throw if array.length is too large.
+
+var length = 4294967295;
+var array = new Array(length);
+
+// Disable any fast paths by adding an indexed property on the prototype chain.
+Array.prototype[0] = 0;
+
+array.splice(100);