From 26a029d407be480d791972afb5975cf62c9360a6 Mon Sep 17 00:00:00 2001 From: Daniel Baumann Date: Fri, 19 Apr 2024 02:47:55 +0200 Subject: Adding upstream version 124.0.1. Signed-off-by: Daniel Baumann --- js/src/jit-test/tests/baseline/bug1368626.js | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) create mode 100644 js/src/jit-test/tests/baseline/bug1368626.js (limited to 'js/src/jit-test/tests/baseline/bug1368626.js') diff --git a/js/src/jit-test/tests/baseline/bug1368626.js b/js/src/jit-test/tests/baseline/bug1368626.js new file mode 100644 index 0000000000..637c98efbb --- /dev/null +++ b/js/src/jit-test/tests/baseline/bug1368626.js @@ -0,0 +1,19 @@ +var sandbox = evalcx("lazy"); + +// Ensure we can't change the "lazy" property of the sandbox to an accessor, +// because that'd allow to execute arbitrary side-effects when calling the +// resolve hook of the sandbox. +var err; +try { + Object.defineProperty(sandbox, "lazy", { + get() { + Object.defineProperty(sandbox, "foo", { value: 0 }); + } + }); +} catch (e) { + err = e; +} +assertEq(err instanceof TypeError, true); + +// Don't assert here. +sandbox.foo = 1; -- cgit v1.2.3