1 files changed, 25 insertions, 0 deletions
diff --git a/js/src/jit-test/tests/ion/bug998059.js b/js/src/jit-test/tests/ion/bug998059.js
new file mode 100644
index 0000000000..fc2c68d7f5
--- /dev/null
+++ b/js/src/jit-test/tests/ion/bug998059.js
@@ -0,0 +1,25 @@
+// Test various ways of changing the behavior of |typedArray.length|.
+
+function addLengthProperty() {
+  var x = new Uint16Array();
+  Object.defineProperty(x, "length", {value:1});
+  for (var i = 0; i < 5; i++)
+    assertEq(x.length, 1);
+}
+addLengthProperty();
+
+function changePrototype() {
+  var x = new Uint16Array();
+  x.__proto__ = [0];
+  for (var i = 0; i < 5; i++)
+    assertEq(x.length, 1);
+}
+changePrototype();
+
+function redefineLengthProperty() {
+  var x = new Uint16Array();
+  Object.defineProperty(Uint16Array.prototype, "length", {value:1});
+  for (var i = 0; i < 5; i++)
+    assertEq(x.length, 1);
+}
+redefineLengthProperty();