1 files changed, 24 insertions, 0 deletions
diff --git a/js/src/jit-test/tests/proxy/bug-862848-1.js b/js/src/jit-test/tests/proxy/bug-862848-1.js
new file mode 100644
index 0000000000..870b5632c3
--- /dev/null
+++ b/js/src/jit-test/tests/proxy/bug-862848-1.js
@@ -0,0 +1,24 @@
+// obj.hasOwnProperty(id), Object.getOwnPropertyDescriptor(obj, id), and
+// Object.defineProperty(obj, id, desc) do not look at obj's prototype.
+
+var angryHandler = new Proxy({}, {
+    has: () => true,
+    get: (t, id) => {
+        throw new Error("angryHandler should not be queried (" + id + ")");
+    }
+});
+var angryProto = new Proxy({}, angryHandler);
+
+var obj = Object.create(angryProto, {
+    // Define hasOwnProperty directly on obj since we are poisoning its
+    // prototype chain.
+    hasOwnProperty: {
+        value: Object.prototype.hasOwnProperty
+    }
+});
+
+assertEq(Object.getOwnPropertyDescriptor(obj, "foo"), undefined);
+assertEq(obj.hasOwnProperty("foo"), false);
+Object.defineProperty(obj, "foo", {value: 5});
+assertEq(obj.hasOwnProperty("foo"), true);
+assertEq(obj.foo, 5);