08aec7d721
The order in which ToNumber(left) and ToPrimitive(right,hint Number) is called when performing an abstract relational comparison is observable, and we need to make sure to trigger the conversions in the correct order. Bug: chromium:687063 Change-Id: Idc9edb99643c4cf1774b89dcdc319ed5dc7cdc8a Reviewed-on: https://chromium-review.googlesource.com/1236557 Reviewed-by: Ross McIlroy <rmcilroy@chromium.org> Reviewed-by: Benedikt Meurer <bmeurer@chromium.org> Commit-Queue: Benedikt Meurer <bmeurer@chromium.org> Cr-Commit-Position: refs/heads/master@{#56125}
32 lines
982 B
JavaScript
32 lines
982 B
JavaScript
// Copyright 2018 the V8 project authors. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style license that can be
|
|
// found in the LICENSE file.
|
|
|
|
// Flags: --allow-natives-syntax
|
|
|
|
// Collect the actual properties looked up on the Proxy.
|
|
const actual = [];
|
|
|
|
// Perform a relational comparison with a Proxy on the right hand
|
|
// side and a Symbol which cannot be turned into a Number on the
|
|
// left hand side.
|
|
function foo() {
|
|
actual.length = 0;
|
|
const lhs = Symbol();
|
|
const rhs = new Proxy({}, {
|
|
get: function(target, property, receiver) {
|
|
actual.push(property);
|
|
return undefined;
|
|
}
|
|
});
|
|
return lhs < rhs;
|
|
}
|
|
|
|
assertThrows(foo, TypeError);
|
|
assertEquals([Symbol.toPrimitive, 'valueOf', 'toString'], actual);
|
|
assertThrows(foo, TypeError);
|
|
assertEquals([Symbol.toPrimitive, 'valueOf', 'toString'], actual);
|
|
%OptimizeFunctionOnNextCall(foo);
|
|
assertThrows(foo, TypeError);
|
|
assertEquals([Symbol.toPrimitive, 'valueOf', 'toString'], actual);
|