1 files changed, 40 insertions, 0 deletions
diff --git a/js/src/tests/test262/built-ins/TypedArray/prototype/slice/arraylength-internal.js b/js/src/tests/test262/built-ins/TypedArray/prototype/slice/arraylength-internal.js
new file mode 100644
index 0000000000..6a7431fdd4
--- /dev/null
+++ b/js/src/tests/test262/built-ins/TypedArray/prototype/slice/arraylength-internal.js
@@ -0,0 +1,40 @@
+// Copyright (C) 2016 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-%typedarray%.prototype.slice
+description: Use internal ArrayLength instead of getting a length property
+info: |
+  22.2.3.24 %TypedArray%.prototype.slice ( start, end )
+
+  ...
+  3. Let len be the value of O's [[ArrayLength]] internal slot.
+  ...
+includes: [testTypedArray.js]
+features: [TypedArray]
+---*/
+
+var getCalls = 0;
+var desc = {
+  get: function getLen() {
+    getCalls++;
+    return 0;
+  }
+};
+
+Object.defineProperty(TypedArray.prototype, "length", desc);
+
+testWithTypedArrayConstructors(function(TA) {
+  var sample = new TA([42, 43]);
+
+  Object.defineProperty(TA.prototype, "length", desc);
+  Object.defineProperty(sample, "length", desc);
+
+  var result = sample.slice();
+
+  assert.sameValue(getCalls, 0, "ignores length properties");
+  assert.sameValue(result[0], 42);
+  assert.sameValue(result[1], 43);
+  assert.sameValue(result.hasOwnProperty(2), false);
+});
+
+reportCompare(0, 0);