1 files changed, 20 insertions, 0 deletions
diff --git a/js/src/jit-test/tests/arrays/species-redefine-getter.js b/js/src/jit-test/tests/arrays/species-redefine-getter.js
new file mode 100644
index 0000000000..94ab329c08
--- /dev/null
+++ b/js/src/jit-test/tests/arrays/species-redefine-getter.js
@@ -0,0 +1,20 @@
+// Ensure the HadGetterSetterChange flag is set.
+Object.defineProperty(Array, "foo", {configurable: true, get: function() {}});
+Object.defineProperty(Array, "foo", {configurable: true, get: function() {}});
+
+// Initialize ArraySpeciesLookup.
+let a = [1, 2, 3];
+for (let i = 0; i < 5; i++) {
+    assertEq(a.slice().length, 3);
+}
+
+// Redefine the Array[Symbol.species] getter without changing its attributes/shape.
+let count = 0;
+Object.defineProperty(Array, Symbol.species,
+                      {get: function() { count++; }, enumerable: false, configurable: true});
+
+// Ensure ArraySpeciesLookup now deoptimizes and calls the getter.
+for (let i = 0; i < 5; i++) {
+    assertEq(a.slice().length, 3);
+}
+assertEq(count, 5);