diff --git a/jerry-core/ecma/builtin-objects/ecma-builtin-array-prototype.c b/jerry-core/ecma/builtin-objects/ecma-builtin-array-prototype.c
index cb60ed14e..53391eae6 100644
--- a/jerry-core/ecma/builtin-objects/ecma-builtin-array-prototype.c
+++ b/jerry-core/ecma/builtin-objects/ecma-builtin-array-prototype.c
@@ -2543,6 +2543,7 @@ ecma_builtin_array_prototype_object_copy_within (const ecma_value_t args[], /**<
     {
       if (obj_p->u1.property_list_cp != JMEM_CP_NULL)
       {
+        count = JERRY_MIN (ext_obj_p->u.array.length, count);
         ecma_value_t *buffer_p = ECMA_GET_NON_NULL_POINTER (ecma_value_t, obj_p->u1.property_list_cp);
 
         for (; count > 0; count--)
diff --git a/tests/jerry/es.next/regression-test-issue-4146.js b/tests/jerry/es.next/regression-test-issue-4146.js
new file mode 100644
index 000000000..f136f8b28
--- /dev/null
+++ b/tests/jerry/es.next/regression-test-issue-4146.js
@@ -0,0 +1,49 @@
+// Copyright JS Foundation and other contributors, http://js.foundation
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// helper function - simple implementation
+Array.prototype.equals = function (array) {
+  if (this.length != array.length)
+    return false;
+
+  for (var i = 0; i < this.length; i++) {
+    if (this[i] instanceof Array && array[i] instanceof Array) {
+      if (!this[i].equals(array[i]))
+        return false;
+      }
+      else if (this[i] != array[i]) {
+        return false;
+    }
+  }
+
+  return true;
+}
+
+function longDenseArray(){
+        var a = [0];
+        for(var i = 0; i < 200; i++){
+                a[i] = i;
+        }
+        return a;
+}
+
+function shorten(){
+        currArray.length = 20;
+        return 1;
+}
+
+var currArray = longDenseArray();
+assert (currArray.copyWithin (200, {valueOf: shorten}).length == 20)
+var array = [0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19];
+assert (currArray.copyWithin(200, {valueOf: shorten}).equals (array))