diff -r 000000000000 -r 6474c204b198 js/src/tests/ecma/Array/array-length-set-on-nonarray.js
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/js/src/tests/ecma/Array/array-length-set-on-nonarray.js	Wed Dec 31 06:09:35 2014 +0100
@@ -0,0 +1,26 @@
+// Any copyright is dedicated to the Public Domain.
+// http://creativecommons.org/licenses/publicdomain/
+
+//-----------------------------------------------------------------------------
+var BUGNUMBER = 548671;
+var summary =
+  "Don't use a shared-permanent inherited property to implement " +
+  "[].length or (function(){}).length";
+
+print(BUGNUMBER + ": " + summary);
+
+/**************
+ * BEGIN TEST *
+ **************/
+
+var a = [];
+a.p = 1;
+var x = Object.create(a);
+assertEq(x.length, 0);
+assertEq(x.p, 1);
+assertEq(a.length, 0);
+
+if (typeof reportCompare === "function")
+  reportCompare(true, true);
+
+print("All tests passed!");