1 files changed, 20 insertions, 0 deletions
diff --git a/js/src/jit-test/tests/arrays/setelem-one-past-nonwritable-length.js b/js/src/jit-test/tests/arrays/setelem-one-past-nonwritable-length.js
new file mode 100644
index 0000000000..7ea5971c05
--- /dev/null
+++ b/js/src/jit-test/tests/arrays/setelem-one-past-nonwritable-length.js
@@ -0,0 +1,20 @@
+function f(arr, i, v)
+{
+  arr[i] = v;
+}
+
+function test()
+{
+  // Use a much-greater capacity than the eventual non-writable length.
+  var a = [0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15];
+  Object.defineProperty(a, "length", { writable: false, value: 6 });
+
+  for (var i = 0; i < 100; i++)
+    f(a, a.length, i);
+
+  assertEq(a.hasOwnProperty(6), false);
+  assertEq(a[6], undefined);
+  assertEq(a.length, 6);
+}
+
+test();