1 files changed, 41 insertions, 0 deletions
diff --git a/js/src/tests/test262/built-ins/DataView/prototype/setInt16/range-check-after-value-conversion.js b/js/src/tests/test262/built-ins/DataView/prototype/setInt16/range-check-after-value-conversion.js
new file mode 100644
index 0000000000..5feddb7aa1
--- /dev/null
+++ b/js/src/tests/test262/built-ins/DataView/prototype/setInt16/range-check-after-value-conversion.js
@@ -0,0 +1,41 @@
+// Copyright (C) 2015 André Bargull. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+esid: sec-dataview.prototype.setint16
+description: >
+  Index bounds checks are performed after value conversion.
+info: |
+  ...
+  3. Return SetViewValue(v, byteOffset, littleEndian, "Int16", value).
+
+  24.2.1.2 SetViewValue ( view, requestIndex, isLittleEndian, type, value )
+    ...
+    3. Let numberIndex be ToNumber(requestIndex).
+    4. Let getIndex be ? ToInteger(numberIndex).
+    ...
+    6. Let numberValue be ? ToNumber(value).
+    ...
+    11. Let viewSize be the value of view's [[ByteLength]] internal slot.
+    12. Let elementSize be the Number value of the Element Size value specified in Table 49 for Element Type type.
+    13. If getIndex + elementSize > viewSize, throw a RangeError exception.
+    ...
+---*/
+
+var dataView = new DataView(new ArrayBuffer(8), 0);
+
+var poisoned = {
+  valueOf: function() {
+    throw new Test262Error();
+  }
+};
+
+assert.throws(Test262Error, function() {
+  dataView.setInt16(100, poisoned);
+}, "setInt16(100, poisoned)");
+
+assert.throws(Test262Error, function() {
+  dataView.setInt16('100', poisoned);
+}, "setInt16('100', poisoned)");
+
+reportCompare(0, 0);