1 files changed, 23 insertions, 0 deletions
diff --git a/js/src/jit-test/tests/gc/oomInArrayProtoTest.js b/js/src/jit-test/tests/gc/oomInArrayProtoTest.js
new file mode 100644
index 000000000..f52846859
--- /dev/null
+++ b/js/src/jit-test/tests/gc/oomInArrayProtoTest.js
@@ -0,0 +1,23 @@
+if (!('oomTest' in this))
+    quit();
+
+function arrayProtoOutOfRange() {
+    function f(obj) {
+        return typeof obj[15];
+    }
+
+    function test() {
+        var a = [1, 2];
+        a.__proto__ = {15: 1337};
+        var b = [1, 2, 3, 4];
+
+        for (var i = 0; i < 200; i++) {
+            var r = f(i % 2 ? a : b);
+            assertEq(r, i % 2 ? "number" : "undefined");
+        }
+    }
+
+    test();
+}
+
+oomTest(arrayProtoOutOfRange);