050ad1d840
This reverts commit e55e0aa5bd.
Reason for revert: speculative revert for tsan breakage
https://logs.chromium.org/logs/v8/buildbucket/cr-buildbucket.appspot.com/8907588363297935904/+/steps/Check__flakes_/0/logs/regress-437713/0
Original change's description:
> [runtime] Fix protector invalidation
>
> Protectors trigger when special properties are modified or masked. Previously
> we would check whether the property stored on the holder would invalidate the
> protector. Stores to to the receiver rather than the holder, however, so this
> CL changes holder for receiver, and adds additional checks that were missing.
>
> Bug: v8:9466
> Change-Id: I81bc3d73f91381da0d254e9eb79365ae2d25d998
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1708468
> Commit-Queue: Leszek Swirski <leszeks@chromium.org>
> Reviewed-by: Leszek Swirski <leszeks@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#62805}
TBR=leszeks@chromium.org,verwaest@chromium.org
Change-Id: Id8fc36525b7c5631589a67073ad1fd5815ea2775
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:9466
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1708482
Reviewed-by: Sathya Gunasekaran <gsathya@chromium.org>
Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62807}
31 lines
1019 B
JavaScript
31 lines
1019 B
JavaScript
// Copyright 2018 the V8 project authors. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style license that can be
|
|
// found in the LICENSE file.
|
|
|
|
// Flags: --allow-natives-syntax --no-stress-opt
|
|
|
|
// This tests the interaction between the MapIterator protector and SetIterator
|
|
// protector.
|
|
|
|
var map = new Map([[1,2], [2,3], [3,4]]);
|
|
assertTrue(%MapIteratorProtector());
|
|
|
|
var set = new Set([1,2,3]);
|
|
assertTrue(%SetIteratorProtector());
|
|
|
|
var iterator = map.keys();
|
|
iterator[Symbol.iterator] = () => ({next: () => ({done: true})});
|
|
|
|
assertFalse(%MapIteratorProtector());
|
|
assertEquals([[1,2], [2,3], [3,4]], [...map]);
|
|
assertEquals([[1,2], [2,3], [3,4]], [...map.entries()]);
|
|
assertEquals([1,2,3], [...map.keys()]);
|
|
assertEquals([2,3,4], [...map.values()]);
|
|
assertEquals([], [...iterator]);
|
|
|
|
assertFalse(%SetIteratorProtector());
|
|
assertEquals([1,2,3], [...set]);
|
|
assertEquals([[1,1],[2,2],[3,3]], [...set.entries()]);
|
|
assertEquals([1,2,3], [...set.keys()]);
|
|
assertEquals([1,2,3], [...set.values()]);
|