1 files changed, 24 insertions, 0 deletions
diff --git a/js/src/jit-test/tests/arrays/push-slowly-nonwritable-length.js b/js/src/jit-test/tests/arrays/push-slowly-nonwritable-length.js
new file mode 100644
index 0000000000..9cfc455844
--- /dev/null
+++ b/js/src/jit-test/tests/arrays/push-slowly-nonwritable-length.js
@@ -0,0 +1,24 @@
+load(libdir + "asserts.js");
+
+function f(arr, v1, v2)
+{
+  // Ensure array_push_slowly is called by passing more than one argument.
+  arr.push(v1, v2);
+}
+
+function basic()
+{
+  // Use a much-greater capacity than the eventual non-writable length.
+  var a = [0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15];
+  Object.defineProperty(a, "length", { writable: false, value: 6 });
+
+  assertThrowsInstanceOf(() => f(a, 8675309, 3141592), TypeError);
+
+  assertEq(a.hasOwnProperty(6), false);
+  assertEq(a[6], undefined);
+  assertEq(a.hasOwnProperty(7), false);
+  assertEq(a[7], undefined);
+  assertEq(a.length, 6);
+}
+
+basic();