chromium/third_party/blink/web_tests/fast/webgl/shader-deleted-by-accessor.html

<html>
<head>
<script src="../../resources/js-test.js"></script>
<script src="resources/webgl-test.js"></script>
<script src="resources/webgl-test-utils.js"></script>
</head>
<body>
<div id="description"></div>
<div id="console"></div>

<script>

description("Verifies that WebGLRenderingContext::getAttachedShaders doesn't crash when an accessor property is defined on Array.prototype.");

if (window.internals)
    internals.settings.setWebGLErrorsToConsoleEnabled(false);

context = create3DContext();
program = context.createProgram();

shader1 = context.createShader(context.VERTEX_SHADER);
context.attachShader(program, shader1);

for (var i = 0; i < 10; ++i) {
    shader2 = context.createShader(context.FRAGMENT_SHADER);
    context.attachShader(program, shader2);

    Array.prototype.__defineSetter__(0, function() {
        context.detachShader(program, shader2);
        context.deleteShader(shader2);
        shader2 = null;
        gc();
    });

    shaders = context.getAttachedShaders(program);
    context.getShaderParameter(shaders[1], 0);
}
</script>

</body>
</html>