1 files changed, 7 insertions, 0 deletions
diff --git a/js/src/jit-test/tests/auto-regress/bug1593971.js b/js/src/jit-test/tests/auto-regress/bug1593971.js
new file mode 100644
index 0000000000..42ffbbd855
--- /dev/null
+++ b/js/src/jit-test/tests/auto-regress/bug1593971.js
@@ -0,0 +1,7 @@
+var ta = new Uint32Array(10);
+
+// Shadow the %TypedArray.prototype%.length getter.
+Object.defineProperty(ta, "length", {value: 0x1000});
+
+// Call Array.prototype.fill, not %TypedArray.prototype%.fill!
+Array.prototype.fill.call(ta, 0);