1 files changed, 22 insertions, 0 deletions
diff --git a/js/src/jit-test/tests/basic/testSetPropertyFail.js b/js/src/jit-test/tests/basic/testSetPropertyFail.js
new file mode 100644
index 000000000..0ca625760
--- /dev/null
+++ b/js/src/jit-test/tests/basic/testSetPropertyFail.js
@@ -0,0 +1,22 @@
+function test(name, fn, val) {
+    gc();
+    var ok = {}, bad = {};
+    bad.__defineSetter__(name, fn);
+    var arr = [ok, ok, ok, ok, ok, bad];
+
+    var log = '';
+    try {
+        for (var i = 0; i < arr.length; i++) {
+            arr[i][name] = val;
+            log += '.';
+        }
+    } catch (exc) {
+        log += 'E';
+    }
+    assertEq(log, '.....E');
+}
+
+test("x", Function.prototype.call, null);  // TypeError: Function.prototype.call called on incompatible [object Object]
+test("y", Array, 0.1);                     // RangeError: invalid array length
+test(1, Function.prototype.call, null);  // TypeError: Function.prototype.call called on incompatible [object Object]
+test(1, Array, 0.1);                     // RangeError: invalid array length