1 files changed, 26 insertions, 0 deletions
diff --git a/js/src/tests/test262/built-ins/Array/prototype/concat/Array.prototype.concat_array-like-length-to-string-throws.js b/js/src/tests/test262/built-ins/Array/prototype/concat/Array.prototype.concat_array-like-length-to-string-throws.js
new file mode 100644
index 0000000000..64a1fce627
--- /dev/null
+++ b/js/src/tests/test262/built-ins/Array/prototype/concat/Array.prototype.concat_array-like-length-to-string-throws.js
@@ -0,0 +1,26 @@
+// Copyright (c) 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+/*---
+esid: sec-array.prototype.concat
+description: Array.prototype.concat array like length to string throws
+features: [Symbol.isConcatSpreadable]
+---*/
+var objWithPoisonedLengthToString = {
+  "length": {
+    toString: function() {
+      throw new Test262Error();
+    },
+    valueOf: null
+  },
+  "1": "A",
+  "3": "B",
+  "5": "C"
+};
+objWithPoisonedLengthToString[Symbol.isConcatSpreadable] = true;
+assert.throws(Test262Error, function() {
+  [].concat(objWithPoisonedLengthToString);
+}, '[].concat(objWithPoisonedLengthToString) throws a Test262Error exception');
+
+reportCompare(0, 0);