1 files changed, 32 insertions, 0 deletions
diff --git a/js/src/tests/test262/built-ins/TypedArrayConstructors/ctors/buffer-arg/defined-negative-length-sab.js b/js/src/tests/test262/built-ins/TypedArrayConstructors/ctors/buffer-arg/defined-negative-length-sab.js
new file mode 100644
index 0000000000..3e7a33df8a
--- /dev/null
+++ b/js/src/tests/test262/built-ins/TypedArrayConstructors/ctors/buffer-arg/defined-negative-length-sab.js
@@ -0,0 +1,32 @@
+// |reftest| skip-if(!this.hasOwnProperty('SharedArrayBuffer')) -- SharedArrayBuffer is not enabled unconditionally
+// Copyright (C) 2016 the V8 project authors. All rights reserved.
+// Copyright (C) 2017 Mozilla Corporation. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-typedarray-buffer-byteoffset-length
+description: >
+  Throws RangeError for negative ToInteger(length)
+info: |
+  22.2.4.5 TypedArray ( buffer [ , byteOffset [ , length ] ] )
+
+  This description applies only if the TypedArray function is called with at
+  least one argument and the Type of the first argument is Object and that
+  object has an [[ArrayBufferData]] internal slot.
+
+includes: [testTypedArray.js]
+features: [SharedArrayBuffer, TypedArray]
+---*/
+
+var buffer = new SharedArrayBuffer(16);
+
+testWithTypedArrayConstructors(function(TA) {
+  assert.throws(RangeError, function() {
+    new TA(buffer, 0, -1);
+  });
+
+  assert.throws(RangeError, function() {
+    new TA(buffer, 0, -Infinity);
+  });
+});
+
+reportCompare(0, 0);