e10fdbed6d
Creating proto-recursive proxies might lead to instanceof while-looping endlessly in Object::HasInPrototypeChain (For traps we already have stack guards in place to prevent stack overflows). We prevent this by limiting the number of proxies we visit in PrototypeIterator to a magic large number. LOG=n BUG=v8:1534 Review URL: https://codereview.chromium.org/1542583003 Cr-Commit-Position: refs/heads/master@{#33007}
63 lines
1.7 KiB
JavaScript
63 lines
1.7 KiB
JavaScript
// Copyright 2015 the V8 project authors. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style license that can be
|
|
// found in the LICENSE file.
|
|
|
|
|
|
// Flags: --harmony-proxies --allow-natives-syntax
|
|
|
|
// Test instanceof with proxies.
|
|
|
|
(function TestInstanceOfWithProxies() {
|
|
function foo(x) {
|
|
return x instanceof Array;
|
|
}
|
|
assertTrue(foo([]));
|
|
assertFalse(foo({}));
|
|
%OptimizeFunctionOnNextCall(foo);
|
|
assertTrue(foo([]));
|
|
assertFalse(foo({}));
|
|
|
|
var handler = {
|
|
getPrototypeOf: function(target) { return Array.prototype; }
|
|
};
|
|
var p = new Proxy({}, handler);
|
|
assertTrue(foo(p));
|
|
var o = {};
|
|
o.__proto__ = p;
|
|
assertTrue(foo(o));
|
|
|
|
// Make sure we are also correct if the handler throws.
|
|
handler.getPrototypeOf = function(target) {
|
|
throw "uncooperative";
|
|
}
|
|
assertThrows("foo(o)");
|
|
|
|
// Including if the optimized function has a catch handler.
|
|
function foo_catch(x) {
|
|
try {
|
|
x instanceof Array;
|
|
} catch(e) {
|
|
assertEquals("uncooperative", e);
|
|
return true;
|
|
}
|
|
return false;
|
|
}
|
|
assertTrue(foo_catch(o));
|
|
%OptimizeFunctionOnNextCall(foo_catch);
|
|
assertTrue(foo_catch(o));
|
|
handler.getPrototypeOf = function(target) { return Array.prototype; }
|
|
assertFalse(foo_catch(o));
|
|
})();
|
|
|
|
|
|
(function testInstanceOfWithRecursiveProxy() {
|
|
// Make sure we gracefully deal with recursive proxies.
|
|
var proxy = new Proxy({},{});
|
|
proxy.__proto__ = proxy;
|
|
// instanceof will cause an inifinite prototype walk.
|
|
assertThrows(() => { proxy instanceof Object }, RangeError);
|
|
|
|
var proxy2 = new Proxy({}, {getPrototypeOf() { return proxy2 }});
|
|
assertThrows(() => { proxy instanceof Object }, RangeError);
|
|
})();
|