60d3ce727f
The MapIterator protector protects the original iteration behaviors of Map.prototype.keys(), Map.prototype.values(), and Set.prototype.entries(). It does not protect the original iteration behavior of Map.prototype[Symbol.iterator](). The protector is invalidated when: * The 'next' property is set on an object where the property holder is the %MapIteratorPrototype% (e.g. because the object is that very prototype). * The 'Symbol.iterator' property is set on an object where the property holder is the %IteratorPrototype%. Note that this also invalidates the SetIterator protector (see below). The SetIterator protector protects the original iteration behavior of Set.prototype.keys(), Set.prototype.values(), Set.prototype.entries(), and Set.prototype[Symbol.iterator](). The protector is invalidated when: * The 'next' property is set on an object where the property holder is the %SetIteratorPrototype% (e.g. because the object is that very prototype). * The 'Symbol.iterator' property is set on an object where the property holder is the %SetPrototype% OR %IteratorPrototype%. This means that setting Symbol.iterator on a MapIterator object can also invalidate the SetIterator protector, and vice versa, setting Symbol.iterator on a SetIterator object can also invalidate the MapIterator. This is an over- approximation for the sake of simplicity. Bug: v8:7980 Change-Id: I54ad6e4c7f19ccc27d7001f6c4b6c8d6ea4ee871 Reviewed-on: https://chromium-review.googlesource.com/c/1273102 Reviewed-by: Georg Neis <neis@chromium.org> Reviewed-by: Ulan Degenbaev <ulan@chromium.org> Reviewed-by: Benedikt Meurer <bmeurer@chromium.org> Commit-Queue: Hai Dang <dhai@google.com> Cr-Commit-Position: refs/heads/master@{#56530}
24 lines
760 B
JavaScript
24 lines
760 B
JavaScript
// Copyright 2018 the V8 project authors. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style license that can be
|
|
// found in the LICENSE file.
|
|
|
|
// Flags: --allow-natives-syntax --no-stress-opt
|
|
|
|
var set = new Set([1,2,3]);
|
|
|
|
assertTrue(%SetIteratorProtector());
|
|
assertTrue(%MapIteratorProtector());
|
|
|
|
// This changes %SetIteratorPrototype%. No more tests should be run after this
|
|
// in the same instance.
|
|
var iterator = set[Symbol.iterator]();
|
|
iterator.__proto__.next = () => ({done: true});
|
|
|
|
assertFalse(%SetIteratorProtector());
|
|
assertTrue(%MapIteratorProtector());
|
|
assertEquals([], [...set]);
|
|
assertEquals([], [...set.entries()]);
|
|
assertEquals([], [...set.keys()]);
|
|
assertEquals([], [...set.values()]);
|
|
assertEquals([], [...iterator]);
|