3b597bb701
This fixes a corner-case in {KeyAccumulator::CollectOwnJSProxyKeys}
where the keys returned by {JSReceiver::OwnPropertyKeys} for an array
are not internalized and hence have a diverging identity from keys
returned by the "ownKeys" trap of a proxy.
R=cbruni@chromium.org
TEST=mjsunit/regress/regress-crbug-700678
BUG=chromium:700678
Change-Id: I5efd012eade14bd45c69e4abb0aeda684baf38f0
Reviewed-on: https://chromium-review.googlesource.com/452979
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43775}
21 lines
752 B
JavaScript
21 lines
752 B
JavaScript
// Copyright 2017 the V8 project authors. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style license that can be
|
|
// found in the LICENSE file.
|
|
|
|
(function testNonConfigurableProperty() {
|
|
function ownKeys(x) { return ["23", "length"]; }
|
|
var target = [];
|
|
var proxy = new Proxy(target, {ownKeys:ownKeys});
|
|
Object.defineProperty(target, "23", {value:true});
|
|
assertEquals(["23", "length"], Object.getOwnPropertyNames(proxy));
|
|
})();
|
|
|
|
(function testPreventedExtension() {
|
|
function ownKeys(x) { return ["42", "length"]; }
|
|
var target = [];
|
|
var proxy = new Proxy(target, {ownKeys:ownKeys});
|
|
target[42] = true;
|
|
Object.preventExtensions(target);
|
|
assertEquals(["42", "length"], Object.getOwnPropertyNames(proxy));
|
|
})();
|