From 823af01575c4c4c96e6092095508ddd00f66e561 Mon Sep 17 00:00:00 2001
From: Richard Gibson <richard.gibson@gmail.com>
Date: Tue, 30 Oct 2018 11:27:37 -0400
Subject: [PATCH] Assert error when invoking RegExp source getter on
 cross-realm RegExp.prototype

RegExp.prototype is not a RegExp, and the algorithm only special-cases
(same-realm) %RegExpPrototype%.
---
 .../RegExp/prototype/source/this-val-invalid-obj.js         | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/test/built-ins/RegExp/prototype/source/this-val-invalid-obj.js b/test/built-ins/RegExp/prototype/source/this-val-invalid-obj.js
index bf136a4abe..6d2af3fab0 100644
--- a/test/built-ins/RegExp/prototype/source/this-val-invalid-obj.js
+++ b/test/built-ins/RegExp/prototype/source/this-val-invalid-obj.js
@@ -13,6 +13,8 @@ info: |
 ---*/
 
 var get = Object.getOwnPropertyDescriptor(RegExp.prototype, 'source').get;
+var otherRealm = $262.createRealm().global;
+var otherRealmRegExpProto = otherRealm.RegExp.prototype;
 
 assert.throws(TypeError, function() {
   get.call({});
@@ -25,3 +27,7 @@ assert.throws(TypeError, function() {
 assert.throws(TypeError, function() {
   get.call(arguments);
 }, 'arguments object');
+
+assert.throws(TypeError, function() {
+  get.call(otherRealmRegExpProto);
+}, 'cross-realm RegExp.prototype');