From 36d22d82aa202bb199967e9512281e9a53db42c9 Mon Sep 17 00:00:00 2001 From: Daniel Baumann Date: Sun, 7 Apr 2024 21:33:14 +0200 Subject: Adding upstream version 115.7.0esr. Signed-off-by: Daniel Baumann --- js/src/jit-test/tests/baseline/bug1368626.js | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) create mode 100644 js/src/jit-test/tests/baseline/bug1368626.js (limited to 'js/src/jit-test/tests/baseline/bug1368626.js') diff --git a/js/src/jit-test/tests/baseline/bug1368626.js b/js/src/jit-test/tests/baseline/bug1368626.js new file mode 100644 index 0000000000..637c98efbb --- /dev/null +++ b/js/src/jit-test/tests/baseline/bug1368626.js @@ -0,0 +1,19 @@ +var sandbox = evalcx("lazy"); + +// Ensure we can't change the "lazy" property of the sandbox to an accessor, +// because that'd allow to execute arbitrary side-effects when calling the +// resolve hook of the sandbox. +var err; +try { + Object.defineProperty(sandbox, "lazy", { + get() { + Object.defineProperty(sandbox, "foo", { value: 0 }); + } + }); +} catch (e) { + err = e; +} +assertEq(err instanceof TypeError, true); + +// Don't assert here. +sandbox.foo = 1; -- cgit v1.2.3