1 files changed, 45 insertions, 0 deletions
diff --git a/js/src/tests/test262/built-ins/RegExp/prototype/Symbol.split/str-result-get-length-err.js b/js/src/tests/test262/built-ins/RegExp/prototype/Symbol.split/str-result-get-length-err.js
new file mode 100644
index 0000000000..ec7e011813
--- /dev/null
+++ b/js/src/tests/test262/built-ins/RegExp/prototype/Symbol.split/str-result-get-length-err.js
@@ -0,0 +1,45 @@
+// Copyright (C) 2015 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+es6id: 21.2.5.11
+description: >
+    Behavior when error thrown while accessing `length` property of match
+    result
+info: |
+    [...]
+    24. Repeat, while q < size
+        a. Let setStatus be Set(splitter, "lastIndex", q, true).
+        [...]
+        c. Let z be RegExpExec(splitter, S).
+        [...]
+        f. Else z is not null,
+           iv. Else e ≠ p,
+               [...]
+               7. Let numberOfCaptures be ToLength(Get(z, "length")).
+               8. ReturnIfAbrupt(numberOfCaptures).
+features: [Symbol.split, Symbol.species]
+---*/
+
+var obj = {
+  constructor: function() {}
+};
+var poisonedLength = {
+  get length() {
+    throw new Test262Error();
+  }
+};
+var fakeRe = {
+  exec: function() {
+    return poisonedLength;
+  }
+};
+obj.constructor[Symbol.species] = function() {
+  return fakeRe;
+};
+
+assert.throws(Test262Error, function() {
+  RegExp.prototype[Symbol.split].call(obj, 'abcd');
+});
+
+reportCompare(0, 0);