1 files changed, 31 insertions, 0 deletions
diff --git a/js/src/tests/test262/built-ins/Array/length/define-own-prop-length-overflow-order.js b/js/src/tests/test262/built-ins/Array/length/define-own-prop-length-overflow-order.js
new file mode 100644
index 0000000000..9cdb0d3860
--- /dev/null
+++ b/js/src/tests/test262/built-ins/Array/length/define-own-prop-length-overflow-order.js
@@ -0,0 +1,31 @@
+// Copyright (C) 2020 Alexey Shvayka. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+esid: sec-arraysetlength
+description: >
+  [[Value]] is checked for overflow before descriptor validation.
+info: |
+  ArraySetLength ( A, Desc )
+
+  [...]
+  3. Let newLen be ? ToUint32(Desc.[[Value]]).
+  4. Let numberLen be ? ToNumber(Desc.[[Value]]).
+  5. If newLen ≠ numberLen, throw a RangeError exception.
+---*/
+
+assert.throws(RangeError, function() {
+  Object.defineProperty([], "length", {value: -1, configurable: true});
+}, 'Object.defineProperty([], "length", {value: -1, configurable: true}) throws a RangeError exception');
+
+assert.throws(RangeError, function() {
+  Object.defineProperty([], "length", {value: NaN, enumerable: true});
+}, 'Object.defineProperty([], "length", {value: NaN, enumerable: true}) throws a RangeError exception');
+
+var array = [];
+Object.defineProperty(array, "length", {writable: false});
+assert.throws(RangeError, function() {
+  Object.defineProperty(array, "length", {value: Number.MAX_SAFE_INTEGER, writable: true});
+}, 'Object.defineProperty(array, "length", {value: Number.MAX_SAFE_INTEGER, writable: true}) throws a RangeError exception');
+
+reportCompare(0, 0);