1 files changed, 35 insertions, 0 deletions
diff --git a/js/src/tests/test262/built-ins/Array/prototype/reverse/length-exceeding-integer-limit-with-object.js b/js/src/tests/test262/built-ins/Array/prototype/reverse/length-exceeding-integer-limit-with-object.js
new file mode 100644
index 0000000000..056478532c
--- /dev/null
+++ b/js/src/tests/test262/built-ins/Array/prototype/reverse/length-exceeding-integer-limit-with-object.js
@@ -0,0 +1,35 @@
+// Copyright (C) 2017 André Bargull. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+esid: sec-array.prototype.reverse
+description: >
+  Ensure reverse() implementation correctly handles length exceeding 2^53-1 with plain objects.
+info: |
+  ...
+  2. Let len be ? ToLength(? Get(O, "length")).
+  ...
+features: [exponentiation]
+---*/
+
+function StopReverse() {}
+
+// Object with large "length" property and no indexed properties in the uint32 range.
+var arrayLike = {
+  get "9007199254740990" () {
+    throw new StopReverse();
+  },
+  get "9007199254740991" () {
+    throw new Test262Error("Get 9007199254740991");
+  },
+  get "9007199254740992" () {
+    throw new Test262Error("Get 9007199254740992");
+  },
+  length: 2 ** 53 + 2,
+};
+
+assert.throws(StopReverse, function() {
+  Array.prototype.reverse.call(arrayLike);
+});
+
+reportCompare(0, 0);