9c766330e0
This is a reland of e55e0aa5bd
Original change's description:
> [runtime] Fix protector invalidation
>
> Protectors trigger when special properties are modified or masked. Previously
> we would check whether the property stored on the holder would invalidate the
> protector. Stores to to the receiver rather than the holder, however, so this
> CL changes holder for receiver, and adds additional checks that were missing.
>
> Bug: v8:9466
> Change-Id: I81bc3d73f91381da0d254e9eb79365ae2d25d998
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1708468
> Commit-Queue: Leszek Swirski <leszeks@chromium.org>
> Reviewed-by: Leszek Swirski <leszeks@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#62805}
Tbr: leszeks@chromium.org
Bug: v8:9466
Change-Id: I693c73577ca9a35a271f509770cc1c87e5cc4b73
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1709420
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Sathya Gunasekaran <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62829}
33 lines
1.1 KiB
JavaScript
33 lines
1.1 KiB
JavaScript
// Copyright 2018 the V8 project authors. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style license that can be
|
|
// found in the LICENSE file.
|
|
|
|
// Flags: --allow-natives-syntax --no-stress-opt
|
|
|
|
// This tests the interaction between the MapIterator protector and SetIterator
|
|
// protector.
|
|
|
|
var map = new Map([[1,2], [2,3], [3,4]]);
|
|
assertTrue(%MapIteratorProtector());
|
|
|
|
var set = new Set([1,2,3]);
|
|
assertTrue(%SetIteratorProtector());
|
|
|
|
// This changes %MapIteratorPrototype%. No more tests should be run after this
|
|
// in the same instance.
|
|
var iterator = map.keys();
|
|
iterator.__proto__[Symbol.iterator] = () => ({next: () => ({done: true})});
|
|
|
|
assertFalse(%MapIteratorProtector());
|
|
assertEquals([[1,2], [2,3], [3,4]], [...map]);
|
|
assertEquals([], [...map.entries()]);
|
|
assertEquals([], [...map.keys()]);
|
|
assertEquals([], [...map.values()]);
|
|
assertEquals([], [...iterator]);
|
|
|
|
assertTrue(%SetIteratorProtector());
|
|
assertEquals([1,2,3], [...set]);
|
|
assertEquals([[1,1],[2,2],[3,3]], [...set.entries()]);
|
|
assertEquals([1,2,3], [...set.keys()]);
|
|
assertEquals([1,2,3], [...set.values()]);
|