v8/test/mjsunit/regress/regress-crbug-917076.js
Benedikt Meurer b6bcf3210a [async] The Promise.all() fast-path must check @@species protector.
We cannot take the fast-path if the user messed with the Symbol.species
property on the Promise.prototype, as that makes the internal promises
observable.

Bug: chromium:917076
Change-Id: I928e0bd17836ca78cf88591610526aa7bc1d293c
Reviewed-on: https://chromium-review.googlesource.com/c/1396426
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58563}
2019-01-07 08:22:56 +00:00

21 lines
484 B
JavaScript

// Copyright 2019 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --allow-natives-syntax
let speciesCounter = 0;
Object.defineProperty(Promise, Symbol.species, {
value: function(...args) {
speciesCounter++;
return new Promise(...args);
}
});
async function foo() { }
assertPromiseResult(Promise.all([foo()]), () => {
assertEquals(3, speciesCounter);
});