Change Promise properties to internal properties (#2526)

There was an issue in the Promise implementation where properties were accessible from JavaScript.
ie. `Object.defineProperty(Object.prototype, 0, {})` could modify properties which should've been inaccessible.
The reason behind that is somewhat interesting as 0-7 were the same values as the enum values in the property list of the Promise object.
Changing these properties to internal, makes them inaccessible from JS side.

Also some tests have been changed, namely 2490 and 2465.
The 2490 one got renamed, and all of the testcases from the issue have been added.
2465 got changed as well, since currently our Promise implementation can't display Promise errors, so we should check if an error is correctly returned.

Fixes #2490

Co-authored-by: Robert Fancsik <frobert@inf.u-szeged.hu>
JerryScript-DCO-1.0-Signed-off-by: Daniel Balla dballa@inf.u-szeged.hu

12 files changed, 107 insertions, 58 deletions

diff --git a/jerry-core/api/jerry-snapshot.h b/jerry-core/api/jerry-snapshot.h
index ce7a088a..9544f0fe 100644
--- a/jerry-core/api/jerry-snapshot.h
+++ b/jerry-core/api/jerry-snapshot.h
@@ -41,7 +41,7 @@ typedef struct
 /**
  * Jerry snapshot format version.
  */
-#define JERRY_SNAPSHOT_VERSION (17u)
+#define JERRY_SNAPSHOT_VERSION (18u)
 
 /**
  * Snapshot configuration flags.
diff --git a/jerry-core/ecma/builtin-objects/ecma-builtin-promise.c b/jerry-core/ecma/builtin-objects/ecma-builtin-promise.c
index f9367380..949024f7 100644
--- a/jerry-core/ecma/builtin-objects/ecma-builtin-promise.c
+++ b/jerry-core/ecma/builtin-objects/ecma-builtin-promise.c
@@ -83,11 +83,11 @@ ecma_builtin_promise_reject_or_resolve (ecma_value_t this_arg, /**< "this" argum
 
   if (is_resolve)
   {
-    property_str_p = ecma_get_ecma_string_from_uint32 (ECMA_PROMISE_PROPERTY_RESOLVE);
+    property_str_p = ecma_get_magic_string (LIT_INTERNAL_MAGIC_STRING_PROMISE_PROPERTY_RESOLVE);
   }
   else
   {
-    property_str_p = ecma_get_ecma_string_from_uint32 (ECMA_PROMISE_PROPERTY_REJECT);
+    property_str_p = ecma_get_magic_string (LIT_INTERNAL_MAGIC_STRING_PROMISE_PROPERTY_REJECT);
   }
 
   ecma_value_t func = ecma_op_object_get (ecma_get_object_from_value (capability), property_str_p);
@@ -106,7 +106,7 @@ ecma_builtin_promise_reject_or_resolve (ecma_value_t this_arg, /**< "this" argum
 
   ecma_free_value (call_ret);
 
-  ecma_string_t *promise_str_p = ecma_get_ecma_string_from_uint32 (ECMA_PROMISE_PROPERTY_PROMISE);
+  ecma_string_t *promise_str_p = ecma_get_magic_string (LIT_INTERNAL_MAGIC_STRING_PROMISE_PROPERTY_PROMISE);
   ecma_value_t promise_new = ecma_op_object_get (ecma_get_object_from_value (capability), promise_str_p);
   ecma_free_value (capability);
 
@@ -127,7 +127,7 @@ ecma_builtin_promise_reject_abrupt (ecma_value_t capability) /**< reject descrip
 {
   ecma_raise_type_error (ECMA_ERR_MSG ("Second argument is not an array."));
   ecma_value_t reason = JERRY_CONTEXT (error_value);
-  ecma_string_t *reject_str_p = ecma_get_ecma_string_from_uint32 (ECMA_PROMISE_PROPERTY_REJECT);
+  ecma_string_t *reject_str_p = ecma_get_magic_string (LIT_INTERNAL_MAGIC_STRING_PROMISE_PROPERTY_REJECT);
   ecma_value_t reject = ecma_op_object_get (ecma_get_object_from_value (capability), reject_str_p);
 
   ecma_value_t call_ret = ecma_op_function_call (ecma_get_object_from_value (reject),
@@ -144,7 +144,7 @@ ecma_builtin_promise_reject_abrupt (ecma_value_t capability) /**< reject descrip
 
   ecma_free_value (call_ret);
 
-  ecma_string_t *promise_str_p = ecma_get_ecma_string_from_uint32 (ECMA_PROMISE_PROPERTY_PROMISE);
+  ecma_string_t *promise_str_p = ecma_get_magic_string (LIT_INTERNAL_MAGIC_STRING_PROMISE_PROPERTY_PROMISE);
   ecma_value_t promise_new = ecma_op_object_get (ecma_get_object_from_value (capability), promise_str_p);
 
   return promise_new;
@@ -208,9 +208,9 @@ ecma_builtin_promise_do_race (ecma_value_t array, /**< the array for race */
   ecma_length_t len = (ecma_length_t) ecma_get_integer_from_value (len_value);
   ecma_fast_free_value (len_value);
 
-  ecma_string_t *promise_str_p = ecma_get_ecma_string_from_uint32 (ECMA_PROMISE_PROPERTY_PROMISE);
-  ecma_string_t *resolve_str_p = ecma_get_ecma_string_from_uint32 (ECMA_PROMISE_PROPERTY_RESOLVE);
-  ecma_string_t *reject_str_p = ecma_get_ecma_string_from_uint32 (ECMA_PROMISE_PROPERTY_REJECT);
+  ecma_string_t *promise_str_p = ecma_get_magic_string (LIT_INTERNAL_MAGIC_STRING_PROMISE_PROPERTY_PROMISE);
+  ecma_string_t *resolve_str_p = ecma_get_magic_string (LIT_INTERNAL_MAGIC_STRING_PROMISE_PROPERTY_RESOLVE);
+  ecma_string_t *reject_str_p = ecma_get_magic_string (LIT_INTERNAL_MAGIC_STRING_PROMISE_PROPERTY_REJECT);
 
   ecma_value_t resolve = ecma_op_object_get (ecma_get_object_from_value (capability),
                                              resolve_str_p);
@@ -318,7 +318,8 @@ ecma_builtin_promise_all_handler (const ecma_value_t function, /**< the function
   ecma_value_t ret = ECMA_VALUE_UNDEFINED;
   /* 1. */
   ecma_object_t *function_p = ecma_get_object_from_value (function);
-  ecma_string_t *already_called_str_p = ecma_get_ecma_string_from_uint32 (ECMA_PROMISE_PROPERTY_ALREADY_CALLED);
+  ecma_string_t *already_called_str_p;
+  already_called_str_p = ecma_get_magic_string (LIT_INTERNAL_MAGIC_STRING_PROMISE_PROPERTY_ALREADY_CALLED);
   ecma_value_t already_called = ecma_op_object_get (function_p, already_called_str_p);
 
   JERRY_ASSERT (ecma_is_value_boolean (already_called));
@@ -336,10 +337,10 @@ ecma_builtin_promise_all_handler (const ecma_value_t function, /**< the function
                       ecma_make_boolean_value (true),
                       false);
 
-  ecma_string_t *str_index_p = ecma_get_ecma_string_from_uint32 (ECMA_PROMISE_PROPERTY_INDEX);
-  ecma_string_t *str_value_p = ecma_get_ecma_string_from_uint32 (ECMA_PROMISE_PROPERTY_VALUE);
-  ecma_string_t *str_capability_p = ecma_get_ecma_string_from_uint32 (ECMA_PROMISE_PROPERTY_CAPABILITY);
-  ecma_string_t *str_remaining_p = ecma_get_ecma_string_from_uint32 (ECMA_PROMISE_PROPERTY_REMAINING_ELEMENT);
+  ecma_string_t *str_index_p = ecma_get_magic_string (LIT_INTERNAL_MAGIC_STRING_PROMISE_PROPERTY_INDEX);
+  ecma_string_t *str_value_p = ecma_get_magic_string (LIT_INTERNAL_MAGIC_STRING_PROMISE_PROPERTY_VALUE);
+  ecma_string_t *str_capability_p = ecma_get_magic_string (LIT_INTERNAL_MAGIC_STRING_PROMISE_PROPERTY_CAPABILITY);
+  ecma_string_t *str_remaining_p = ecma_get_magic_string (LIT_INTERNAL_MAGIC_STRING_PROMISE_PROPERTY_REMAINING_ELEMENT);
 
   /* 4-7. */
   ecma_value_t index_val = ecma_op_object_get (function_p, str_index_p);
@@ -361,7 +362,7 @@ ecma_builtin_promise_all_handler (const ecma_value_t function, /**< the function
   /* 9-10. */
   if (ecma_builtin_promise_remaining_inc_or_dec (remaining, false) == 0)
   {
-    ecma_string_t *resolve_str_p = ecma_get_ecma_string_from_uint32 (ECMA_PROMISE_PROPERTY_RESOLVE);
+    ecma_string_t *resolve_str_p = ecma_get_magic_string (LIT_INTERNAL_MAGIC_STRING_PROMISE_PROPERTY_RESOLVE);
     ecma_value_t resolve = ecma_op_object_get (ecma_get_object_from_value (capability), resolve_str_p);
 
     ret = ecma_op_function_call (ecma_get_object_from_value (resolve),
@@ -406,14 +407,15 @@ ecma_builtin_promise_do_all (ecma_value_t array, /**< the array for all */
   ecma_length_t len = (ecma_length_t) ecma_get_integer_from_value (len_value);
   ecma_fast_free_value (len_value);
 
-  ecma_string_t *promise_str_p = ecma_get_ecma_string_from_uint32 (ECMA_PROMISE_PROPERTY_PROMISE);
-  ecma_string_t *resolve_str_p = ecma_get_ecma_string_from_uint32 (ECMA_PROMISE_PROPERTY_RESOLVE);
-  ecma_string_t *reject_str_p = ecma_get_ecma_string_from_uint32 (ECMA_PROMISE_PROPERTY_REJECT);
-  ecma_string_t *already_called_str_p = ecma_get_ecma_string_from_uint32 (ECMA_PROMISE_PROPERTY_ALREADY_CALLED);
-  ecma_string_t *index_str_p = ecma_get_ecma_string_from_uint32 (ECMA_PROMISE_PROPERTY_INDEX);
-  ecma_string_t *value_str_p = ecma_get_ecma_string_from_uint32 (ECMA_PROMISE_PROPERTY_VALUE);
-  ecma_string_t *capability_str_p = ecma_get_ecma_string_from_uint32 (ECMA_PROMISE_PROPERTY_CAPABILITY);
-  ecma_string_t *remaining_str_p = ecma_get_ecma_string_from_uint32 (ECMA_PROMISE_PROPERTY_REMAINING_ELEMENT);
+  ecma_string_t *promise_str_p = ecma_get_magic_string (LIT_INTERNAL_MAGIC_STRING_PROMISE_PROPERTY_PROMISE);
+  ecma_string_t *resolve_str_p = ecma_get_magic_string (LIT_INTERNAL_MAGIC_STRING_PROMISE_PROPERTY_RESOLVE);
+  ecma_string_t *reject_str_p = ecma_get_magic_string (LIT_INTERNAL_MAGIC_STRING_PROMISE_PROPERTY_REJECT);
+  ecma_string_t *already_called_str_p;
+  already_called_str_p = ecma_get_magic_string (LIT_INTERNAL_MAGIC_STRING_PROMISE_PROPERTY_ALREADY_CALLED);
+  ecma_string_t *index_str_p = ecma_get_magic_string (LIT_INTERNAL_MAGIC_STRING_PROMISE_PROPERTY_INDEX);
+  ecma_string_t *value_str_p = ecma_get_magic_string (LIT_INTERNAL_MAGIC_STRING_PROMISE_PROPERTY_VALUE);
+  ecma_string_t *capability_str_p = ecma_get_magic_string (LIT_INTERNAL_MAGIC_STRING_PROMISE_PROPERTY_CAPABILITY);
+  ecma_string_t *remaining_str_p = ecma_get_magic_string (LIT_INTERNAL_MAGIC_STRING_PROMISE_PROPERTY_REMAINING_ELEMENT);
 
   ecma_value_t undefined_val = ECMA_VALUE_UNDEFINED;
   /* String '1' indicates [[Resolve]] and '2' indicates [[Reject]]. */
diff --git a/jerry-core/ecma/operations/ecma-jobqueue.c b/jerry-core/ecma/operations/ecma-jobqueue.c
index 7994f3ca..90105275 100644
--- a/jerry-core/ecma/operations/ecma-jobqueue.c
+++ b/jerry-core/ecma/operations/ecma-jobqueue.c
@@ -145,10 +145,10 @@ ecma_process_promise_reaction_job (void *obj_p) /**< the job to be operated */
   ecma_job_promise_reaction_t *job_p = (ecma_job_promise_reaction_t *) obj_p;
   ecma_object_t *reaction_p = ecma_get_object_from_value (job_p->reaction);
 
-  ecma_string_t *capability_str_p = ecma_get_ecma_string_from_uint32 (ECMA_PROMISE_PROPERTY_CAPABILITY);
-  ecma_string_t *handler_str_p = ecma_get_ecma_string_from_uint32 (ECMA_PROMISE_PROPERTY_HANDLER);
-  ecma_string_t *resolve_str_p = ecma_get_ecma_string_from_uint32 (ECMA_PROMISE_PROPERTY_RESOLVE);
-  ecma_string_t *reject_str_p = ecma_get_ecma_string_from_uint32 (ECMA_PROMISE_PROPERTY_REJECT);
+  ecma_string_t *capability_str_p = ecma_get_magic_string (LIT_INTERNAL_MAGIC_STRING_PROMISE_PROPERTY_CAPABILITY);
+  ecma_string_t *handler_str_p = ecma_get_magic_string (LIT_INTERNAL_MAGIC_STRING_PROMISE_PROPERTY_HANDLER);
+  ecma_string_t *resolve_str_p = ecma_get_magic_string (LIT_INTERNAL_MAGIC_STRING_PROMISE_PROPERTY_RESOLVE);
+  ecma_string_t *reject_str_p = ecma_get_magic_string (LIT_INTERNAL_MAGIC_STRING_PROMISE_PROPERTY_REJECT);
 
   /* 2. */
   ecma_value_t capability = ecma_op_object_get (reaction_p, capability_str_p);
diff --git a/jerry-core/ecma/operations/ecma-promise-object.c b/jerry-core/ecma/operations/ecma-promise-object.c
index 869bffc8..6529bb5b 100644
--- a/jerry-core/ecma/operations/ecma-promise-object.c
+++ b/jerry-core/ecma/operations/ecma-promise-object.c
@@ -362,9 +362,9 @@ ecma_call_builtin_executor (ecma_object_t *executor_p, /**< the executor object
                             ecma_value_t resolve_func, /**< the resolve function */
                             ecma_value_t reject_func) /**< the reject function */
 {
-  ecma_string_t *capability_str_p = ecma_get_ecma_string_from_uint32 (ECMA_PROMISE_PROPERTY_CAPABILITY);
-  ecma_string_t *resolve_str_p = ecma_get_ecma_string_from_uint32 (ECMA_PROMISE_PROPERTY_RESOLVE);
-  ecma_string_t *reject_str_p = ecma_get_ecma_string_from_uint32 (ECMA_PROMISE_PROPERTY_REJECT);
+  ecma_string_t *capability_str_p = ecma_get_magic_string (LIT_INTERNAL_MAGIC_STRING_PROMISE_PROPERTY_CAPABILITY);
+  ecma_string_t *resolve_str_p = ecma_get_magic_string (LIT_INTERNAL_MAGIC_STRING_PROMISE_PROPERTY_RESOLVE);
+  ecma_string_t *reject_str_p = ecma_get_magic_string (LIT_INTERNAL_MAGIC_STRING_PROMISE_PROPERTY_REJECT);
 
   /* 2. */
   ecma_value_t capability = ecma_op_object_get (executor_p, capability_str_p);
@@ -585,8 +585,8 @@ ecma_promise_new_capability (void)
   /* 3. */
   ecma_object_t *capability_p = ecma_op_create_object_object_noarg ();
 
-  ecma_string_t *capability_str_p = ecma_get_ecma_string_from_uint32 (ECMA_PROMISE_PROPERTY_CAPABILITY);
-  ecma_string_t *promise_str_p = ecma_get_ecma_string_from_uint32 (ECMA_PROMISE_PROPERTY_PROMISE);
+  ecma_string_t *capability_str_p = ecma_get_magic_string (LIT_INTERNAL_MAGIC_STRING_PROMISE_PROPERTY_CAPABILITY);
+  ecma_string_t *promise_str_p = ecma_get_magic_string (LIT_INTERNAL_MAGIC_STRING_PROMISE_PROPERTY_PROMISE);
   /* 4. */
   ecma_object_t *executor_p;
   executor_p = ecma_op_create_object_object_noarg ();
@@ -618,7 +618,7 @@ ecma_promise_new_capability (void)
 
   ecma_free_value (promise);
   /* 8. */
-  ecma_string_t *resolve_str_p = ecma_get_ecma_string_from_uint32 (ECMA_PROMISE_PROPERTY_RESOLVE);
+  ecma_string_t *resolve_str_p = ecma_get_magic_string (LIT_INTERNAL_MAGIC_STRING_PROMISE_PROPERTY_RESOLVE);
   ecma_value_t resolve = ecma_op_object_get (capability_p, resolve_str_p);
 
   if (!ecma_op_is_callable (resolve))
@@ -630,7 +630,7 @@ ecma_promise_new_capability (void)
 
   ecma_free_value (resolve);
   /* 9. */
-  ecma_string_t *reject_str_p = ecma_get_ecma_string_from_uint32 (ECMA_PROMISE_PROPERTY_REJECT);
+  ecma_string_t *reject_str_p = ecma_get_magic_string (LIT_INTERNAL_MAGIC_STRING_PROMISE_PROPERTY_REJECT);
   ecma_value_t reject = ecma_op_object_get (capability_p, reject_str_p);
 
   if (!ecma_op_is_callable (reject))
@@ -660,9 +660,9 @@ ecma_promise_do_then (ecma_value_t promise, /**< the promise which call 'then' *
                       ecma_value_t on_rejected, /**< on_rejected function */
                       ecma_value_t result_capability) /**< promise capability */
 {
-  ecma_string_t *capability_str_p = ecma_get_ecma_string_from_uint32 (ECMA_PROMISE_PROPERTY_CAPABILITY);
-  ecma_string_t *handler_str_p = ecma_get_ecma_string_from_uint32 (ECMA_PROMISE_PROPERTY_HANDLER);
-  ecma_string_t *promise_str_p = ecma_get_ecma_string_from_uint32 (ECMA_PROMISE_PROPERTY_PROMISE);
+  ecma_string_t *capability_str_p = ecma_get_magic_string (LIT_INTERNAL_MAGIC_STRING_PROMISE_PROPERTY_CAPABILITY);
+  ecma_string_t *handler_str_p = ecma_get_magic_string (LIT_INTERNAL_MAGIC_STRING_PROMISE_PROPERTY_HANDLER);
+  ecma_string_t *promise_str_p = ecma_get_magic_string (LIT_INTERNAL_MAGIC_STRING_PROMISE_PROPERTY_PROMISE);
 
   /* 3. boolean true indicates "indentity" */
   if (!ecma_op_is_callable (on_fulfilled))
diff --git a/jerry-core/ecma/operations/ecma-promise-object.h b/jerry-core/ecma/operations/ecma-promise-object.h
index a32018b6..ce82abe3 100644
--- a/jerry-core/ecma/operations/ecma-promise-object.h
+++ b/jerry-core/ecma/operations/ecma-promise-object.h
@@ -68,23 +68,6 @@ typedef struct
   ecma_collection_header_t *reject_reactions; /**< list of PromiseRejectReactions */
 } ecma_promise_object_t;
 
-/**
- * Use symbolic constant to represent the internal property name of
- * promise related structures.
- */
-typedef enum
-{
-  ECMA_PROMISE_PROPERTY_PROMISE, /**< [[Promise]] property */
-  ECMA_PROMISE_PROPERTY_RESOLVE, /**< [[Resolve]] property */
-  ECMA_PROMISE_PROPERTY_REJECT, /**< [[Reject]] property */
-  ECMA_PROMISE_PROPERTY_CAPABILITY, /**< [[Capability]] property */
-  ECMA_PROMISE_PROPERTY_HANDLER, /**< [[Handler]] property */
-  ECMA_PROMISE_PROPERTY_ALREADY_CALLED, /**< [[AlreadyCalled]] property */
-  ECMA_PROMISE_PROPERTY_INDEX, /**< [[Index]] property */
-  ECMA_PROMISE_PROPERTY_VALUE, /**< [[Values]] property */
-  ECMA_PROMISE_PROPERTY_REMAINING_ELEMENT /**< [[RemainingElement]] property */
-} ecma_promise_property_symbolic_constant_t;
-
 bool ecma_is_promise (ecma_object_t *obj_p);
 ecma_value_t
 ecma_op_create_promise_object (ecma_value_t executor, ecma_promise_executor_type_t type);
diff --git a/jerry-core/lit/lit-magic-strings.h b/jerry-core/lit/lit-magic-strings.h
index a9bb4d18..0e94b17a 100644
--- a/jerry-core/lit/lit-magic-strings.h
+++ b/jerry-core/lit/lit-magic-strings.h
@@ -37,10 +37,20 @@ typedef enum
   LIT_INTERNAL_MAGIC_STRING_ALREADY_RESOLVED, /**< [[AlreadyResolved]] of promise reject or resolve functions */
   LIT_INTERNAL_MAGIC_STRING_RESOLVE_FUNCTION, /**< the resolve funtion of the promise object */
   LIT_INTERNAL_MAGIC_STRING_REJECT_FUNCTION, /**< the reject function of the promise object */
+  LIT_INTERNAL_MAGIC_STRING_PROMISE_PROPERTY_PROMISE, /**< [[Promise]] property */
+  LIT_INTERNAL_MAGIC_STRING_PROMISE_PROPERTY_RESOLVE, /**< [[Resolve]] property */
+  LIT_INTERNAL_MAGIC_STRING_PROMISE_PROPERTY_REJECT, /**< [[Reject]] property */
+  LIT_INTERNAL_MAGIC_STRING_PROMISE_PROPERTY_CAPABILITY, /**< [[Capability]] property */
+  LIT_INTERNAL_MAGIC_STRING_PROMISE_PROPERTY_HANDLER, /**< [[Handler]] property */
+  LIT_INTERNAL_MAGIC_STRING_PROMISE_PROPERTY_ALREADY_CALLED, /**< [[AlreadyCalled]] property */
+  LIT_INTERNAL_MAGIC_STRING_PROMISE_PROPERTY_INDEX, /**< [[Index]] property */
+  LIT_INTERNAL_MAGIC_STRING_PROMISE_PROPERTY_VALUE, /**< [[Values]] property */
+  LIT_INTERNAL_MAGIC_STRING_PROMISE_PROPERTY_REMAINING_ELEMENT, /**< [[RemainingElement]] property */
   LIT_GC_MARK_REQUIRED_MAGIC_STRING__COUNT,  /**< number of internal magic strings which will be used as
                                               *   property names, and their values need to be marked during gc. */
   LIT_INTERNAL_MAGIC_STRING_DELETED = LIT_GC_MARK_REQUIRED_MAGIC_STRING__COUNT, /**< special value for
                                                                                  *   deleted properties */
+
   LIT_INTERNAL_MAGIC_STRING_NATIVE_POINTER, /**< native pointer info associated with an object */
   LIT_MAGIC_STRING__COUNT /**< number of magic strings */
 } lit_magic_string_id_t;
diff --git a/tests/jerry/fail/regression-test-issue-2490-variant2.js b/tests/jerry/es2015/regression-test-issue-2465.js
index d0175e2f..c8a45395 100644
--- a/tests/jerry/fail/regression-test-issue-2490-variant2.js
+++ b/tests/jerry/es2015/regression-test-issue-2465.js
@@ -12,5 +12,8 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
-Object.defineProperty(Object.prototype, 2, {});
-Promise.all([0]);
+var a = eval("Object.prototype[1] = 0;\
+              Promise.all()")
+a.catch(function(err) {
+  assert(err instanceof TypeError);
+});
diff --git a/tests/jerry/fail/regression-test-issue-2468.js b/tests/jerry/es2015/regression-test-issue-2468.js
index c1db62a0..c1db62a0 100644
--- a/tests/jerry/fail/regression-test-issue-2468.js
+++ b/tests/jerry/es2015/regression-test-issue-2468.js
diff --git a/tests/jerry/fail/regression-test-issue-2465.js b/tests/jerry/es2015/regression-test-issue-2489-original.js
index 32ac02ae..50308bce 100644
--- a/tests/jerry/fail/regression-test-issue-2465.js
+++ b/tests/jerry/es2015/regression-test-issue-2489-original.js
@@ -12,5 +12,6 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
-Object.prototype[1] = 0;
+// This test case should not throw an error anymore.
+Object.defineProperty(Object.prototype, 0, {'get': function() { throw $ }});
 Promise.all();
diff --git a/tests/jerry/es2015/regression-test-issue-2490.js b/tests/jerry/es2015/regression-test-issue-2490.js
new file mode 100644
index 00000000..6f48b706
--- /dev/null
+++ b/tests/jerry/es2015/regression-test-issue-2490.js
@@ -0,0 +1,41 @@
+// Copyright JS Foundation and other contributors, http://js.foundation
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// Original issue
+Object.defineProperty(Object.prototype, 6, {});
+Promise.all([0]);
+
+// Variant 2
+Object.defineProperty(Object.prototype, 2, {});
+Promise.all([0]);
+
+// Variant 3
+Object.defineProperty(Object.prototype, 3, {});
+Promise.all([0]);
+
+// Variant 4
+Object.defineProperty(Object.prototype, 4, {});
+Promise.all([0]);
+
+// Variant 5
+Object.defineProperty(Object.prototype, 5, {});
+Promise.all([0]);
+
+// Variant 7
+Object.defineProperty(Object.prototype, 7, {});
+Promise.all([0]);
+
+// Variant 8
+Object.defineProperty(Object.prototype, 8, {});
+Promise.all([0]);
diff --git a/tests/jerry/fail/regression-test-issue-2489.js b/tests/jerry/fail/regression-test-issue-2489.js
index 223af742..7788c32e 100644
--- a/tests/jerry/fail/regression-test-issue-2489.js
+++ b/tests/jerry/fail/regression-test-issue-2489.js
@@ -13,4 +13,13 @@
 // limitations under the License.
 
 Object.defineProperty(Object.prototype, 0, {'get': function() { throw $ }});
+/**
+ * The below line is added becase the patch #2526 introduces internal properties for promises.
+ * The Reference Error this issue produced can still be reproduced by calling this line.
+ * The reason it was present before is that Promise's 0th property was Promise which could be modified
+ * with the above line, and the engine getting that property for internal purposes got the `throw $` instead.
+ * Thanks to internal properties, it can't be modified anymore from JS side, therefore Promise won't trigger the error.
+ * To keep this issue's output as it was before, the `Array.prototype[0];` line is added.
+ */
+Array.prototype[0];
 Promise.all();
diff --git a/tests/unit-core/test-snapshot.c b/tests/unit-core/test-snapshot.c
index bc1ef102..fe38e2f2 100644
--- a/tests/unit-core/test-snapshot.c
+++ b/tests/unit-core/test-snapshot.c
@@ -223,7 +223,7 @@ main (void)
     /* Check the snapshot data. Unused bytes should be filled with zeroes */
     const uint8_t expected_data[] =
     {
-      0x4A, 0x52, 0x52, 0x59, 0x11, 0x00, 0x00, 0x00,
+      0x4A, 0x52, 0x52, 0x59, 0x12, 0x00, 0x00, 0x00,
       0x00, 0x00, 0x00, 0x00, 0x48, 0x00, 0x00, 0x00,
       0x01, 0x00, 0x00, 0x00, 0x18, 0x00, 0x00, 0x00,
       0x03, 0x00, 0x01, 0x00, 0x01, 0x00, 0x01, 0x00,