1 files changed, 12 insertions, 0 deletions
diff --git a/js/src/jit-test/tests/basic/bug1814000.js b/js/src/jit-test/tests/basic/bug1814000.js
new file mode 100644
index 0000000000..1a0d47f947
--- /dev/null
+++ b/js/src/jit-test/tests/basic/bug1814000.js
@@ -0,0 +1,12 @@
+// Don't crash because we're exposing a ScriptSourceObject to JS.
+evaluate(`
+const src = \`
+    [function f() {
+        const v = eval("[]");
+        v[0] = function() {};
+        newGlobal({sameZoneAs: this}).findPath(v, src);
+    }]
+\`;
+var arr = eval(src);
+arr[0]();
+`, {envChainObject: {}});