60d3ce727f
The MapIterator protector protects the original iteration behaviors of Map.prototype.keys(), Map.prototype.values(), and Set.prototype.entries(). It does not protect the original iteration behavior of Map.prototype[Symbol.iterator](). The protector is invalidated when: * The 'next' property is set on an object where the property holder is the %MapIteratorPrototype% (e.g. because the object is that very prototype). * The 'Symbol.iterator' property is set on an object where the property holder is the %IteratorPrototype%. Note that this also invalidates the SetIterator protector (see below). The SetIterator protector protects the original iteration behavior of Set.prototype.keys(), Set.prototype.values(), Set.prototype.entries(), and Set.prototype[Symbol.iterator](). The protector is invalidated when: * The 'next' property is set on an object where the property holder is the %SetIteratorPrototype% (e.g. because the object is that very prototype). * The 'Symbol.iterator' property is set on an object where the property holder is the %SetPrototype% OR %IteratorPrototype%. This means that setting Symbol.iterator on a MapIterator object can also invalidate the SetIterator protector, and vice versa, setting Symbol.iterator on a SetIterator object can also invalidate the MapIterator. This is an over- approximation for the sake of simplicity. Bug: v8:7980 Change-Id: I54ad6e4c7f19ccc27d7001f6c4b6c8d6ea4ee871 Reviewed-on: https://chromium-review.googlesource.com/c/1273102 Reviewed-by: Georg Neis <neis@chromium.org> Reviewed-by: Ulan Degenbaev <ulan@chromium.org> Reviewed-by: Benedikt Meurer <bmeurer@chromium.org> Commit-Queue: Hai Dang <dhai@google.com> Cr-Commit-Position: refs/heads/master@{#56530}
23 lines
764 B
JavaScript
23 lines
764 B
JavaScript
// Copyright 2018 the V8 project authors. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style license that can be
|
|
// found in the LICENSE file.
|
|
|
|
// Flags: --allow-natives-syntax --no-stress-opt
|
|
|
|
var map = new Map([[1,2], [2,3], [3,4]]);
|
|
assertTrue(%MapIteratorProtector());
|
|
assertTrue(%SetIteratorProtector());
|
|
|
|
// This changes %MapIteratorPrototype%. No more tests should be run after this
|
|
// in the same instance.
|
|
var iterator = map.entries();
|
|
iterator.__proto__.next = () => ({done: true});
|
|
|
|
assertFalse(%MapIteratorProtector());
|
|
assertTrue(%SetIteratorProtector());
|
|
assertEquals([], [...map]);
|
|
assertEquals([], [...map.entries()]);
|
|
assertEquals([], [...map.keys()]);
|
|
assertEquals([], [...map.values()]);
|
|
assertEquals([], [...iterator]);
|