1 files changed, 24 insertions, 0 deletions
diff --git a/js/src/jit-test/tests/typedarray/define-property-oob.js b/js/src/jit-test/tests/typedarray/define-property-oob.js
new file mode 100644
index 0000000000..a4afac3a57
--- /dev/null
+++ b/js/src/jit-test/tests/typedarray/define-property-oob.js
@@ -0,0 +1,24 @@
+const ta = new Int32Array(1);
+const desc = {value: 0, writable: true, enumerable: true, configurable: true};
+
+// Out-of-bounds with an int32 index.
+for (let i = 0; i < 1000; ++i) {
+  let didThrow = false;
+  try {
+    Object.defineProperty(ta, 10, desc);
+  } catch {
+    didThrow = true;
+  }
+  assertEq(didThrow, true);
+}
+
+// Out-of-bounds with a non-int32 index.
+for (let i = 0; i < 1000; ++i) {
+  let didThrow = false;
+  try {
+    Object.defineProperty(ta, 12.3, desc);
+  } catch {
+    didThrow = true;
+  }
+  assertEq(didThrow, true);
+}