55efb6cc5d
- Introduce new helper IsFastJSArrayWithNoCustomIteration.
- Consolidates all entry array checks...
- Is a fast array (defers to BranchIfFastJSArray)
- No possibility that the Array's iteration protocol has been tampered with
- Introduce new BoolT constant helpers Int32TrueConstant and Int32FalseConstant.
Bug: chromium:804176, chromium:804188
Change-Id: I6b08396484682dc680b431ea564a7a28eeab8108
Reviewed-on: https://chromium-review.googlesource.com/883065
Commit-Queue: Peter Wong <peter.wm.wong@gmail.com>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50867}
15 lines
590 B
JavaScript
15 lines
590 B
JavaScript
// Copyright 2018 the V8 project authors. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style license that can be
|
|
// found in the LICENSE file.
|
|
|
|
Object.defineProperty(Array.prototype, Symbol.iterator, {
|
|
value: function* () {}
|
|
});
|
|
const arrayIteratorProto = Object.getPrototypeOf([][Symbol.iterator]());
|
|
arrayIteratorProto.next = function() {};
|
|
|
|
assertThrows(() => new Map([[{}, 1], [{}, 2]]), TypeError);
|
|
assertThrows(() => new WeakMap([[{}, 1], [{}, 2]]), TypeError);
|
|
assertThrows(() => new Set([{}]), TypeError);
|
|
assertThrows(() => new WeakSet([{}]), TypeError);
|