diff --git a/js/xpconnect/tests/chrome/test_bug760109.xul b/js/xpconnect/tests/chrome/test_bug760109.xul
index aa26158d510..27429c7baf7 100644
--- a/js/xpconnect/tests/chrome/test_bug760109.xul
+++ b/js/xpconnect/tests/chrome/test_bug760109.xul
@@ -49,6 +49,7 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=760109
     is(chromeArray.indexOf('b'), 1, "indexOf works correctly");
     is(chromeArray.join(''), concat, "join works correctly");
     is(chromeArray.slice(1).join(''), 'bz', "slice works correctly");
+    is(chromeArray.length, 3, "Able to check array length");
 
     // Try some operations that modify the array.
     is(chromeArray.pop(), 'z', "Able to call pop");
diff --git a/js/xpconnect/tests/unit/test_bug809652.js b/js/xpconnect/tests/unit/test_bug809652.js
new file mode 100644
index 00000000000..7240f8fea5a
--- /dev/null
+++ b/js/xpconnect/tests/unit/test_bug809652.js
@@ -0,0 +1,65 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+/* See https://bugzilla.mozilla.org/show_bug.cgi?id=813901 */
+
+const Cu = Components.utils;
+const TypedArrays = [ Int8Array, Uint8Array, Int16Array, Uint16Array,
+                      Int32Array, Uint32Array, Float32Array, Float64Array,
+                      Uint8ClampedArray ];
+
+// Make sure that the correct nativecall-y stuff is denied on security wrappers.
+
+function run_test() {
+
+  var sb = new Cu.Sandbox('http://www.example.org');
+  sb.obj = {foo: 2};
+
+  /* Set up some typed arrays. */
+  sb.ab = new ArrayBuffer(8);
+  for (var i = 0; i < 8; ++i)
+    new Uint8Array(sb.ab)[i] = i * 10;
+  sb.ta = [];
+  TypedArrays.forEach(function(f) sb.ta.push(new f(sb.ab)));
+  sb.dv = new DataView(sb.ab);
+
+  /* Things that should throw. */
+  checkThrows("Object.prototype.__lookupSetter__('__proto__').call(obj, {});", sb);
+  sb.re = /f/;
+  checkThrows("RegExp.prototype.exec.call(re, 'abcdefg').index", sb);
+  sb.d = new Date();
+  checkThrows("Date.prototype.setYear.call(d, 2011)", sb);
+  sb.m = new Map();
+  checkThrows("(new Map()).clear.call(m)", sb);
+  checkThrows("ArrayBuffer.prototype.__lookupGetter__('byteLength').call(ab);", sb);
+  checkThrows("ArrayBuffer.prototype.slice.call(ab, 0);", sb);
+  checkThrows("DataView.prototype.getInt8.call(dv, 0);", sb);
+
+  /* Things we explicitly allow in ExposedPropertiesOnly::allowNativeCall. */
+
+  /* Date */
+  do_check_eq(Cu.evalInSandbox("Date.prototype.getYear.call(d)", sb), sb.d.getYear());
+  do_check_eq(Cu.evalInSandbox("Date.prototype.valueOf.call(d)", sb), sb.d.valueOf());
+  do_check_eq(Cu.evalInSandbox("d.valueOf()", sb), sb.d.valueOf());
+  do_check_eq(Cu.evalInSandbox("Date.prototype.toString.call(d)", sb), sb.d.toString());
+  do_check_eq(Cu.evalInSandbox("d.toString()", sb), sb.d.toString());
+
+  /* Typed arrays. */
+  function testForTypedArray(t) {
+    sb.curr = t;
+    do_check_eq(Cu.evalInSandbox("this[curr.constructor.name].prototype.subarray.call(curr, 0)[0]", sb), t[0]);
+    do_check_eq(Cu.evalInSandbox("(new this[curr.constructor.name]).__lookupGetter__('length').call(curr)", sb), t.length);
+    do_check_eq(Cu.evalInSandbox("(new this[curr.constructor.name]).__lookupGetter__('buffer').call(curr)", sb), sb.ab);
+    do_check_eq(Cu.evalInSandbox("(new this[curr.constructor.name]).__lookupGetter__('byteOffset').call(curr)", sb), t.byteOffset);
+    do_check_eq(Cu.evalInSandbox("(new this[curr.constructor.name]).__lookupGetter__('byteLength').call(curr)", sb), t.byteLength);
+  }
+  sb.ta.forEach(testForTypedArray);
+}
+
+function checkThrows(expression, sb) {
+  var result = Cu.evalInSandbox('(function() { try { ' + expression + '; return "allowed"; } catch (e) { return e.toString(); }})();', sb);
+  dump('result: ' + result + '\n\n\n');
+  do_check_true(!!/denied/.exec(result));
+}
+
diff --git a/js/xpconnect/tests/unit/xpcshell.ini b/js/xpconnect/tests/unit/xpcshell.ini
index 835f5a7e8cc..9be45117a9a 100644
--- a/js/xpconnect/tests/unit/xpcshell.ini
+++ b/js/xpconnect/tests/unit/xpcshell.ini
@@ -14,6 +14,7 @@ tail =
 [test_bug778409.js]
 [test_bug780370.js]
 [test_bug805807.js]
+[test_bug809652.js]
 [test_bug845201.js]
 [test_bug_442086.js]
 [test_file.js]