From b9cbff73782775448f36bc46ac3dfeec97e8ffa1 Mon Sep 17 00:00:00 2001
From: Alexey Shvayka <shvaikalesh@gmail.com>
Date: Wed, 26 Aug 2020 06:57:42 +0300
Subject: [PATCH] Add poisoned Object.prototype.__proto__ test

---
 .../__proto__-poisoned-object-prototype.js    | 32 +++++++++++++++++++
 1 file changed, 32 insertions(+)
 create mode 100644 test/annexB/language/expressions/object/__proto__-poisoned-object-prototype.js

diff --git a/test/annexB/language/expressions/object/__proto__-poisoned-object-prototype.js b/test/annexB/language/expressions/object/__proto__-poisoned-object-prototype.js
new file mode 100644
index 0000000000..f03c8ebd64
--- /dev/null
+++ b/test/annexB/language/expressions/object/__proto__-poisoned-object-prototype.js
@@ -0,0 +1,32 @@
+// Copyright (C) 2020 Alexey Shvayka. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-__proto__-property-names-in-object-initializers
+description: >
+  The value of the `__proto__` property key is assigned to the [[Prototype]].
+  Object.prototype.__proto__ setter should not be called.
+info: |
+  __proto__ Property Names in Object Initializers
+
+  PropertyDefinition : PropertyName : AssignmentExpression
+
+  [...]
+  7. If isProtoSetter is true, then
+    a. If Type(propValue) is either Object or Null, then
+      i. Return object.[[SetPrototypeOf]](propValue).
+---*/
+
+Object.defineProperty(Object.prototype, '__proto__', {
+  set: function() {
+    throw new Test262Error('should not be called');
+  },
+});
+
+var proto = {};
+
+var object = {
+  __proto__: proto
+};
+
+assert(!object.hasOwnProperty('__proto__'));
+assert.sameValue(Object.getPrototypeOf(object), proto);