1 files changed, 38 insertions, 0 deletions
diff --git a/js/src/jit-test/tests/TypedObject/neutertypedobjunsizedarray.js b/js/src/jit-test/tests/TypedObject/neutertypedobjunsizedarray.js
new file mode 100644
index 000000000..c1c248d72
--- /dev/null
+++ b/js/src/jit-test/tests/TypedObject/neutertypedobjunsizedarray.js
@@ -0,0 +1,38 @@
+// Test the case where we detach the buffer underlying a variable-length array.
+// Here we can fold the detached check into the bounds check.
+
+if (!this.hasOwnProperty("TypedObject"))
+  quit();
+
+var {StructType, uint32, storage} = TypedObject;
+var S = new StructType({f: uint32, g: uint32});
+var A = S.array(10);
+
+function readFrom(a) {
+  return a[2].f + a[2].g;
+}
+
+function main() {
+  var a = new A();
+  a[2].f = 22;
+  a[2].g = 44;
+
+  for (var i = 0; i < 10; i++)
+    assertEq(readFrom(a), 66);
+
+  detachArrayBuffer(storage(a).buffer);
+
+  for (var i = 0; i < 10; i++) {
+    var ok = false;
+
+    try {
+      readFrom(a);
+    } catch (e) {
+      ok = e instanceof TypeError;
+    }
+
+    assertEq(ok, true);
+  }
+}
+
+main();