diff -r 000000000000 -r 6474c204b198 js/src/tests/ecma_5/Array/redefine-length-frozen-dictionarymode-array.js
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/js/src/tests/ecma_5/Array/redefine-length-frozen-dictionarymode-array.js	Wed Dec 31 06:09:35 2014 +0100
@@ -0,0 +1,36 @@
+/*
+ * Any copyright is dedicated to the Public Domain.
+ * http://creativecommons.org/licenses/publicdomain/
+ * Contributor:
+ *   Jeff Walden <jwalden+code@mit.edu>
+ */
+
+//-----------------------------------------------------------------------------
+var BUGNUMBER = 880591;
+var summary =
+  "Assertion redefining length property of a frozen dictionary-mode array";
+
+print(BUGNUMBER + ": " + summary);
+
+/**************
+ * BEGIN TEST *
+ **************/
+
+function convertToDictionaryMode(arr)
+{
+  Object.defineProperty(arr, 0, { configurable: true });
+  Object.defineProperty(arr, 1, { configurable: true });
+  delete arr[0];
+}
+
+var arr = [];
+convertToDictionaryMode(arr);
+Object.freeze(arr);
+Object.defineProperty(arr, "length", {});
+
+/******************************************************************************/
+
+if (typeof reportCompare === "function")
+  reportCompare(true, true);
+
+print("Tests complete");