v8/test/mjsunit/protector-cell/uint16Array-species.js
Sathya Gunasekaran 7bf6d477d4 [runtime] Use instance type checks in LookupIterator::UpdateProtector
Instead of looking up the specific maps in every native context, just
check against the instance type.

Bug: v8:11256
Change-Id: Ib50d599c014c95b03ba3260014dfcbd9ec82982c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2593337
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Sathya Gunasekaran  <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71802}
2020-12-16 17:56:10 +00:00

11 lines
427 B
JavaScript

// Copyright 2020 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --allow-natives-syntax --no-stress-opt
assertTrue(%TypedArraySpeciesProtector());
class MyUint16Array extends Uint16Array { }
Object.defineProperty(Uint16Array, Symbol.species, { value: MyUint16Array });
assertFalse(%TypedArraySpeciesProtector());