bug1814000.js (296B)
1 // Don't crash because we're exposing a ScriptSourceObject to JS. 2 evaluate(` 3 const src = \` 4 [function f() { 5 const v = eval("[]"); 6 v[0] = function() {}; 7 newGlobal({sameZoneAs: this}).findPath(v, src); 8 }] 9 \`; 10 var arr = eval(src); 11 arr[0](); 12 `, {envChainObject: {}});