1 files changed, 24 insertions, 0 deletions
diff --git a/js/src/jit-test/tests/warp/store-element-hole-negative-index.js b/js/src/jit-test/tests/warp/store-element-hole-negative-index.js
new file mode 100644
index 0000000000..43d017769c
--- /dev/null
+++ b/js/src/jit-test/tests/warp/store-element-hole-negative-index.js
@@ -0,0 +1,24 @@
+function test() {
+  Object.defineProperty(Array.prototype, -1, {
+    set() {
+      throw new Error("shouldn't get here");
+    }
+  });
+
+  // A bunch of indices which grow the array.
+  var indices = [];
+  for (var i = 0; i < 10_000; ++i) indices.push(i);
+
+  // And finally a negative index.
+  indices.push(-1);
+
+  // Plain data properties use DefineDataProperty.
+  var desc = {value: 0, writable: true, enumerable: true, configurable: true};
+
+  var a = [];
+  for (var i = 0; i < indices.length; ++i) {
+    Object.defineProperty(a, indices[i], desc);
+  }
+}
+
+test();