1 files changed, 18 insertions, 0 deletions
diff --git a/js/src/jit-test/tests/basic/array-proto-outofrange.js b/js/src/jit-test/tests/basic/array-proto-outofrange.js
new file mode 100644
index 000000000..795f41f72
--- /dev/null
+++ b/js/src/jit-test/tests/basic/array-proto-outofrange.js
@@ -0,0 +1,18 @@
+function f(obj) {
+    return typeof obj[15];
+}
+
+function test() {
+    var a = [1, 2];
+    a.__proto__ = {15: 1337};
+    var b = [1, 2, 3, 4];
+
+    for (var i = 0; i < 1000; i++) {
+        var r = f(i % 2 ? a : b);
+        assertEq(r, i % 2 ? "number" : "undefined");
+    }
+}
+
+test();
+test();
+test();