1 files changed, 18 insertions, 0 deletions
diff --git a/js/src/jit-test/tests/auto-regress/bug1183241.js b/js/src/jit-test/tests/auto-regress/bug1183241.js
new file mode 100644
index 0000000000..6f236afd2e
--- /dev/null
+++ b/js/src/jit-test/tests/auto-regress/bug1183241.js
@@ -0,0 +1,18 @@
+// |jit-test| error:TypeError
+"use strict";
+
+// Make it impossible to create a toSource() representation of |o|, because
+// 100 * 2**22 exceeds the maximum string length.
+var s = "a".repeat(2 ** 22);
+var o = {};
+for (var i = 0; i < 100; ++i) {
+    o["$" + i] = s;
+}
+
+Object.seal(o);
+
+// Before the patch the toSource() represention was generated when an
+// assignment failed in strict mode. And because it's not possible to create
+// a toSource() representation for |o| (see above), this line caused an
+// InternalError to be thrown. With the patch this line throws a TypeError.
+o.foo = 0;