diff -r 000000000000 -r 6474c204b198 js/src/jit-test/tests/basic/splice-fail-step-16.js
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/js/src/jit-test/tests/basic/splice-fail-step-16.js	Wed Dec 31 06:09:35 2014 +0100
@@ -0,0 +1,25 @@
+/* Test that arrays resize normally during splice, even if .length is non-writable. */
+
+var arr = [1, 2, 3, 4, 5, 6];
+
+Object.defineProperty(arr, "length", {writable: false});
+
+try
+{
+  var removed = arr.splice(3, 3, 9, 9, 9, 9);
+  throw new Error("splice didn't throw, returned [" + removed + "]");
+}
+catch (e)
+{
+  assertEq(e instanceof TypeError, true,
+           "should have thrown a TypeError, instead threw " + e + ", arr is " + arr);
+}
+
+// The exception should happen in step 16, which means we've already removed the array elements.
+assertEq(arr[0], 1);
+assertEq(arr[1], 2);
+assertEq(arr[2], 3);
+assertEq(arr[3], 9);
+assertEq(arr[4], 9);
+assertEq(arr[5], 9);
+assertEq(arr.length, 6);