55efb6cc5d
- Introduce new helper IsFastJSArrayWithNoCustomIteration.
- Consolidates all entry array checks...
- Is a fast array (defers to BranchIfFastJSArray)
- No possibility that the Array's iteration protocol has been tampered with
- Introduce new BoolT constant helpers Int32TrueConstant and Int32FalseConstant.
Bug: chromium:804176, chromium:804188
Change-Id: I6b08396484682dc680b431ea564a7a28eeab8108
Reviewed-on: https://chromium-review.googlesource.com/883065
Commit-Queue: Peter Wong <peter.wm.wong@gmail.com>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50867}
14 lines
538 B
JavaScript
14 lines
538 B
JavaScript
// Copyright 2018 the V8 project authors. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style license that can be
|
|
// found in the LICENSE file.
|
|
|
|
const set_entries = [{}];
|
|
set_entries[Symbol.iterator] = function() {};
|
|
assertThrows(() => new Set(set_entries), TypeError);
|
|
assertThrows(() => new WeakSet(set_entries), TypeError);
|
|
|
|
const map_entries = [[{}, 1]];
|
|
map_entries[Symbol.iterator] = function() {};
|
|
assertThrows(() => new Set(map_entries), TypeError);
|
|
assertThrows(() => new WeakSet(map_entries), TypeError);
|