1 files changed, 55 insertions, 0 deletions
diff --git a/js/src/jit-test/tests/cacheir/store-dense-element-hole-non-extensible.js b/js/src/jit-test/tests/cacheir/store-dense-element-hole-non-extensible.js
new file mode 100644
index 0000000000..21ad5f5164
--- /dev/null
+++ b/js/src/jit-test/tests/cacheir/store-dense-element-hole-non-extensible.js
@@ -0,0 +1,55 @@
+// Store an element into a previous hole value and later add more elements
+// exceeding the initialised length. Cover both mono- and polymorphic call
+// sites. Change array length to non-extensible during execution.
+
+function testStoreDenseHole() {
+  var array = [/* hole */, /* hole */, /* hole */, /* hole */, ];
+
+  function store(ar, index) {
+    ar[index] = index;
+  }
+
+  for (var i = 0; i < 10; ++i) {
+    if (i === 5) {
+      Object.preventExtensions(array);
+    }
+    store(array, i);
+  }
+
+  assertEq(array.length, 5);
+  for (var i = 0; i < 5; ++i) {
+    assertEq(array[i], i);
+  }
+  for (var i = 5; i < 10; ++i) {
+    assertEq(i in array, false);
+  }
+}
+testStoreDenseHole();
+
+function testStoreDenseHolePoly() {
+  var array = [/* hole */, /* hole */, /* hole */, /* hole */, ];
+
+  function store(ar, index) {
+    ar[index] = index;
+  }
+
+  var objects = [array, {}];
+
+  for (var i = 0; i < 10; ++i) {
+    if (i === 5) {
+      Object.preventExtensions(array);
+    }
+    for (var j = 0; j < objects.length; ++j) {
+      store(objects[j], i);
+    }
+  }
+
+  assertEq(array.length, 5);
+  for (var i = 0; i < 5; ++i) {
+    assertEq(array[i], i);
+  }
+  for (var i = 5; i < 10; ++i) {
+    assertEq(i in array, false);
+  }
+}
+testStoreDenseHolePoly();