1 files changed, 19 insertions, 0 deletions
diff --git a/js/src/jit-test/tests/baseline/bug1368626.js b/js/src/jit-test/tests/baseline/bug1368626.js
new file mode 100644
index 0000000000..637c98efbb
--- /dev/null
+++ b/js/src/jit-test/tests/baseline/bug1368626.js
@@ -0,0 +1,19 @@
+var sandbox = evalcx("lazy");
+
+// Ensure we can't change the "lazy" property of the sandbox to an accessor,
+// because that'd allow to execute arbitrary side-effects when calling the
+// resolve hook of the sandbox.
+var err;
+try {
+    Object.defineProperty(sandbox, "lazy", {
+        get() {
+            Object.defineProperty(sandbox, "foo", { value: 0 });
+        }
+    });
+} catch (e) {
+    err = e;
+}
+assertEq(err instanceof TypeError, true);
+
+// Don't assert here.
+sandbox.foo = 1;