js/src/jit-test/tests/basic/bug1814000.js


1
2
3
4
5
6
7
8
9
10
11
12

// Don't crash because we're exposing a ScriptSourceObject to JS.
evaluate(`
const src = \`
    [function f() {
        const v = eval("[]");
        v[0] = function() {};
        newGlobal({sameZoneAs: this}).findPath(v, src);
    }]
\`;
var arr = eval(src);
arr[0]();
`, {envChainObject: {}});