1 files changed, 21 insertions, 0 deletions
diff --git a/js/src/jit-test/tests/basic/for-in-densified-elements.js b/js/src/jit-test/tests/basic/for-in-densified-elements.js
new file mode 100644
index 0000000000..4874901f17
--- /dev/null
+++ b/js/src/jit-test/tests/basic/for-in-densified-elements.js
@@ -0,0 +1,21 @@
+function test() {
+    // An array with sparse elements...
+    var arr = [];
+    arr[10_000] = 1;
+    arr[10_001] = 1;
+
+    for (var prop in arr) {
+        assertEq(prop, "10000");
+        assertEq(arr.length, 10_002);
+
+        // Densify the elements.
+        for (var i = 0; i < arr.length; i++) {
+            arr[i] = 1;
+        }
+
+        // Delete the last dense element (10001). It should not be visited by the
+        // active for-in (checked above).
+        arr.length = 10_001;
+    }
+}
+test();