From 5004389bcc729b03b3615917eadc5922c926c0cb Mon Sep 17 00:00:00 2001
From: Dave Liu <7david12liu@gmail.com>
Date: Mon, 13 Jul 2026 15:24:42 -0700
Subject: [PATCH] test: stabilize validation error recapture assertion (#187)

---
 functions/requestValidation.test.js | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/functions/requestValidation.test.js b/functions/requestValidation.test.js
index 9906faf7..1a375fcd 100644
--- a/functions/requestValidation.test.js
+++ b/functions/requestValidation.test.js
@@ -526,9 +526,13 @@ describe('bounded array and string primitives', () => {
     const fabricated = new RequestValidationError(
       REQUEST_VALIDATION_REASONS.INVALID_EMAIL,
     );
+    expect(Object.isFrozen(fabricated)).toBe(true);
     expect(Reflect.set(fabricated, 'message', HOSTILE_CANARY)).toBe(false);
-    expect(Reflect.set(fabricated, 'stack', HOSTILE_CANARY)).toBe(false);
-    expectSafeError(
+    // V8's special lazy Error.stack slot can report or accept this write in
+    // some Jest hosts even when Object.isFrozen is true. The fabricated error
+    // is untrusted; the boundary is that the parser replaces it below.
+    Reflect.set(fabricated, 'stack', HOSTILE_CANARY);
+    const recaptured = expectSafeError(
       () => parseBoundedArray(['safe'], {
         maxItems: 1,
         itemParser: () => {
@@ -537,6 +541,7 @@ describe('bounded array and string primitives', () => {
       }),
       REQUEST_VALIDATION_REASONS.INVALID_VALUE,
     );
+    expect(recaptured).not.toBe(fabricated);
   });
 
   test('recaptures a genuine parser error without a value-derived function name', () => {