| Index: test/mjsunit/error-constructors.js
 | 
| diff --git a/test/mjsunit/error-constructors.js b/test/mjsunit/error-constructors.js
 | 
| index 5c2aac5b8703cb421a69066465d437c6aae9254f..0f3d74c960cfb04ad84be7919e5dca9eeab8338e 100644
 | 
| --- a/test/mjsunit/error-constructors.js
 | 
| +++ b/test/mjsunit/error-constructors.js
 | 
| @@ -69,11 +69,9 @@
 | 
|  assertTrue(e.hasOwnProperty('stack'));
 | 
|  
 | 
|  // Check that intercepting property access from toString is prevented for
 | 
| -// compiler errors. This is not specified, but allowing interception through a
 | 
| -// getter can leak error objects from different script tags in the same context
 | 
| -// in a browser setting. Use Realm.eval as a proxy for loading scripts. We
 | 
| -// ignore the exception thrown from it since that would not be catchable from
 | 
| -// user-land code.
 | 
| +// compiler errors. This is not specified, but allowing interception
 | 
| +// through a getter can leak error objects from different
 | 
| +// script tags in the same context in a browser setting.
 | 
|  var errors = [SyntaxError, ReferenceError, TypeError, RangeError, URIError];
 | 
|  var error_triggers = ["syntax error",
 | 
|                        "var error = reference",
 | 
| @@ -81,12 +79,39 @@
 | 
|                        "String.fromCodePoint(0xFFFFFF)",
 | 
|                        "decodeURI('%F')"];
 | 
|  for (var i in errors) {
 | 
| +  var name = errors[i].name;
 | 
| +
 | 
|    // Monkey-patch prototype.
 | 
| -  for (var prop of ["name", "message", "stack"]) {
 | 
| -    errors[i].prototype.__defineGetter__(prop, fail);
 | 
| +  var props = ["name", "message", "stack"];
 | 
| +  for (var j in props) {
 | 
| +    errors[i].prototype.__defineGetter__(props[j], fail);
 | 
|    }
 | 
|    // String conversion should not invoke monkey-patched getters on prototype.
 | 
| -  assertThrows(()=>Realm.eval(0, error_triggers[i]));
 | 
| +  var error;
 | 
| +  try {
 | 
| +    eval(error_triggers[i]);
 | 
| +  } catch (e) {
 | 
| +    error = e;
 | 
| +  }
 | 
| +  assertTrue(error.toString().startsWith(name));
 | 
| +
 | 
| +  // Deleting message on the error (exposing the getter) is fine.
 | 
| +  delete error.message;
 | 
| +  assertEquals(name, error.toString());
 | 
| +
 | 
| +  // Custom properties shadowing the name are fine.
 | 
| +  var myerror = { name: "myerror", message: "mymessage"};
 | 
| +  myerror.__proto__ = error;
 | 
| +  assertEquals("myerror: mymessage", myerror.toString());
 | 
| +
 | 
| +  // Custom getters in actual objects are welcome.
 | 
| +  error.__defineGetter__("name", function() { return "mine"; });
 | 
| +  assertEquals("mine", error.toString());
 | 
| +
 | 
| +  // Custom properties shadowing the name are fine.
 | 
| +  var myerror2 = { message: "mymessage"};
 | 
| +  myerror2.__proto__ = error;
 | 
| +  assertEquals("mine: mymessage", myerror2.toString());
 | 
|  }
 | 
|  
 | 
|  // Monkey-patching non-internal errors should still be observable.
 | 
| 
 |