1 files changed, 48 insertions, 0 deletions
diff --git a/js/src/tests/non262/Array/splice-species-changes-length.js b/js/src/tests/non262/Array/splice-species-changes-length.js
new file mode 100644
index 0000000000..0e4ed32b01
--- /dev/null
+++ b/js/src/tests/non262/Array/splice-species-changes-length.js
@@ -0,0 +1,48 @@
+// Case 1: splice() removes an element from the array.
+{
+    let array = [];
+    array.push(0, 1, 2);
+
+    array.constructor = {
+        [Symbol.species]: function(n) {
+            // Increase the initialized length of the array.
+            array.push(3, 4, 5);
+
+            // Make the length property non-writable.
+            Object.defineProperty(array, "length", {writable: false});
+
+            return new Array(n);
+        }
+    }
+
+    assertThrowsInstanceOf(() => Array.prototype.splice.call(array, 0, 1), TypeError);
+
+    assertEq(array.length, 6);
+    assertEqArray(array, [1, 2, /* hole */, 3, 4, 5]);
+}
+
+// Case 2: splice() adds an element to the array.
+{
+    let array = [];
+    array.push(0, 1, 2);
+
+    array.constructor = {
+        [Symbol.species]: function(n) {
+            // Increase the initialized length of the array.
+            array.push(3, 4, 5);
+
+            // Make the length property non-writable.
+            Object.defineProperty(array, "length", {writable: false});
+
+            return new Array(n);
+        }
+    }
+
+    assertThrowsInstanceOf(() => Array.prototype.splice.call(array, 0, 0, 123), TypeError);
+
+    assertEq(array.length, 6);
+    assertEqArray(array, [123, 0, 1, 2, 4, 5]);
+}
+
+if (typeof reportCompare === "function")
+    reportCompare(true, true);