1 files changed, 25 insertions, 0 deletions
diff --git a/js/src/jit-test/tests/basic/splice-fail-step-16.js b/js/src/jit-test/tests/basic/splice-fail-step-16.js
new file mode 100644
index 0000000000..549ad0129d
--- /dev/null
+++ b/js/src/jit-test/tests/basic/splice-fail-step-16.js
@@ -0,0 +1,25 @@
+/* Test that arrays resize normally during splice, even if .length is non-writable. */
+
+var arr = [1, 2, 3, 4, 5, 6];
+
+Object.defineProperty(arr, "length", {writable: false});
+
+try
+{
+  var removed = arr.splice(3, 3, 9, 9, 9, 9);
+  throw new Error("splice didn't throw, returned [" + removed + "]");
+}
+catch (e)
+{
+  assertEq(e instanceof TypeError, true,
+           "should have thrown a TypeError, instead threw " + e + ", arr is " + arr);
+}
+
+// The exception should happen in step 16, which means we've already removed the array elements.
+assertEq(arr[0], 1);
+assertEq(arr[1], 2);
+assertEq(arr[2], 3);
+assertEq(arr[3], 9);
+assertEq(arr[4], 9);
+assertEq(arr[5], 9);
+assertEq(arr.length, 6);