diff --git a/test/built-ins/Array/prototype/unshift/set-length-array-is-frozen.js b/test/built-ins/Array/prototype/unshift/set-length-array-is-frozen.js
new file mode 100644
index 0000000000..4ff5038c1a
--- /dev/null
+++ b/test/built-ins/Array/prototype/unshift/set-length-array-is-frozen.js
@@ -0,0 +1,48 @@
+// Copyright (C) 2022 Apple Inc. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-array.prototype.unshift
+description: >
+  A TypeError is thrown when "length" is [[Set]] on a frozen array.
+info: |
+  Array.prototype.unshift ( ...items )
+
+  [...]
+  4. If argCount > 0, then
+    [...]
+    d. Let j be +0𝔽.
+    e. For each element E of items, do
+        i. Perform ? Set(O, ! ToString(j), E, true).
+        ii. Set j to j + 1𝔽.
+  5. Perform ? Set(O, "length", 𝔽(len + argCount), true).
+
+  OrdinarySetWithOwnDescriptor ( O, P, V, Receiver, ownDesc )
+
+  [...]
+  2. If IsDataDescriptor(ownDesc) is true, then
+    a. If ownDesc.[[Writable]] is false, return false.
+
+  Set ( O, P, V, Throw )
+
+  [...]
+  1. Let success be ? O.[[Set]](P, V, O).
+  2. If success is false and Throw is true, throw a TypeError exception.
+---*/
+
+var array = [];
+var arrayPrototypeSet0Calls = 0;
+
+Object.defineProperty(Array.prototype, "0", {
+  set(_val) {
+    Object.freeze(array);
+    arrayPrototypeSet0Calls++;
+  },
+});
+
+assert.throws(TypeError, function() {
+  array.unshift(1);
+});
+
+assert(!array.hasOwnProperty(0));
+assert.sameValue(array.length, 0);
+assert.sameValue(arrayPrototypeSet0Calls, 1);
diff --git a/test/built-ins/Array/prototype/unshift/set-length-array-length-is-non-writable.js b/test/built-ins/Array/prototype/unshift/set-length-array-length-is-non-writable.js
new file mode 100644
index 0000000000..eaa149bf9d
--- /dev/null
+++ b/test/built-ins/Array/prototype/unshift/set-length-array-length-is-non-writable.js
@@ -0,0 +1,48 @@
+// Copyright (C) 2022 Apple Inc. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-array.prototype.unshift
+description: >
+  A TypeError is thrown when "length" is [[Set]] on an array with non-writable "length".
+info: |
+  Array.prototype.unshift ( ...items )
+
+  [...]
+  4. If argCount > 0, then
+    [...]
+    d. Let j be +0𝔽.
+    e. For each element E of items, do
+        i. Perform ? Set(O, ! ToString(j), E, true).
+        ii. Set j to j + 1𝔽.
+  5. Perform ? Set(O, "length", 𝔽(len + argCount), true).
+
+  OrdinarySetWithOwnDescriptor ( O, P, V, Receiver, ownDesc )
+
+  [...]
+  2. If IsDataDescriptor(ownDesc) is true, then
+    a. If ownDesc.[[Writable]] is false, return false.
+
+  Set ( O, P, V, Throw )
+
+  [...]
+  1. Let success be ? O.[[Set]](P, V, O).
+  2. If success is false and Throw is true, throw a TypeError exception.
+---*/
+
+var array = [];
+var arrayPrototypeSet0Calls = 0;
+
+Object.defineProperty(Array.prototype, "0", {
+  set(_val) {
+    Object.defineProperty(array, "length", { writable: false });
+    arrayPrototypeSet0Calls++;
+  },
+});
+
+assert.throws(TypeError, function() {
+  array.unshift(1);
+});
+
+assert(!array.hasOwnProperty(0));
+assert.sameValue(array.length, 0);
+assert.sameValue(arrayPrototypeSet0Calls, 1);
diff --git a/test/built-ins/Array/prototype/unshift/set-length-zero-array-is-frozen.js b/test/built-ins/Array/prototype/unshift/set-length-zero-array-is-frozen.js
new file mode 100644
index 0000000000..a698f62047
--- /dev/null
+++ b/test/built-ins/Array/prototype/unshift/set-length-zero-array-is-frozen.js
@@ -0,0 +1,36 @@
+// Copyright (C) 2022 Apple Inc. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-array.prototype.unshift
+description: >
+  A TypeError is thrown when "length" is [[Set]] on an empty frozen array.
+info: |
+  Array.prototype.unshift ( ...items )
+
+  [...]
+  2. Let len be ? LengthOfArrayLike(O).
+  [...]
+  5. Perform ? Set(O, "length", 𝔽(len + argCount), true).
+
+  OrdinarySetWithOwnDescriptor ( O, P, V, Receiver, ownDesc )
+
+  [...]
+  2. If IsDataDescriptor(ownDesc) is true, then
+    a. If ownDesc.[[Writable]] is false, return false.
+
+  Set ( O, P, V, Throw )
+
+  [...]
+  1. Let success be ? O.[[Set]](P, V, O).
+  2. If success is false and Throw is true, throw a TypeError exception.
+---*/
+
+var array = [];
+Object.freeze(array);
+
+assert.throws(TypeError, function() {
+  array.unshift();
+});
+
+assert(!array.hasOwnProperty(0));
+assert.sameValue(array.length, 0);
diff --git a/test/built-ins/Array/prototype/unshift/set-length-zero-array-length-is-non-writable.js b/test/built-ins/Array/prototype/unshift/set-length-zero-array-length-is-non-writable.js
new file mode 100644
index 0000000000..64bcfa6df0
--- /dev/null
+++ b/test/built-ins/Array/prototype/unshift/set-length-zero-array-length-is-non-writable.js
@@ -0,0 +1,36 @@
+// Copyright (C) 2022 Apple Inc. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-array.prototype.unshift
+description: >
+  A TypeError is thrown when "length" is [[Set]] on an empty array with non-writable "length".
+info: |
+  Array.prototype.unshift ( ...items )
+
+  [...]
+  2. Let len be ? LengthOfArrayLike(O).
+  [...]
+  5. Perform ? Set(O, "length", 𝔽(len + argCount), true).
+
+  OrdinarySetWithOwnDescriptor ( O, P, V, Receiver, ownDesc )
+
+  [...]
+  2. If IsDataDescriptor(ownDesc) is true, then
+    a. If ownDesc.[[Writable]] is false, return false.
+
+  Set ( O, P, V, Throw )
+
+  [...]
+  1. Let success be ? O.[[Set]](P, V, O).
+  2. If success is false and Throw is true, throw a TypeError exception.
+---*/
+
+var array = [];
+Object.defineProperty(array, "length", { writable: false });
+
+assert.throws(TypeError, function() {
+  array.unshift();
+});
+
+assert(!array.hasOwnProperty(0));
+assert.sameValue(array.length, 0);