e55e0aa5bd
Protectors trigger when special properties are modified or masked. Previously we would check whether the property stored on the holder would invalidate the protector. Stores to to the receiver rather than the holder, however, so this CL changes holder for receiver, and adds additional checks that were missing. Bug: v8:9466 Change-Id: I81bc3d73f91381da0d254e9eb79365ae2d25d998 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1708468 Commit-Queue: Leszek Swirski <leszeks@chromium.org> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/master@{#62805}
32 lines
1019 B
JavaScript
32 lines
1019 B
JavaScript
|
|
// Copyright 2018 the V8 project authors. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style license that can be
|
|
// found in the LICENSE file.
|
|
|
|
// Flags: --allow-natives-syntax --no-stress-opt
|
|
|
|
// This tests the interaction between the MapIterator protector and SetIterator
|
|
// protector.
|
|
|
|
var map = new Map([[1,2], [2,3], [3,4]]);
|
|
assertTrue(%MapIteratorProtector());
|
|
|
|
var set = new Set([1,2,3]);
|
|
assertTrue(%SetIteratorProtector());
|
|
|
|
var iterator = set.keys();
|
|
iterator[Symbol.iterator] = () => ({next: () => ({done: true})});
|
|
|
|
assertTrue(%MapIteratorProtector());
|
|
assertEquals([[1,2], [2,3], [3,4]], [...map]);
|
|
assertEquals([[1,2], [2,3], [3,4]], [...map.entries()]);
|
|
assertEquals([1,2,3], [...map.keys()]);
|
|
assertEquals([2,3,4], [...map.values()]);
|
|
|
|
assertFalse(%SetIteratorProtector());
|
|
assertEquals([[1,1],[2,2],[3,3]], [...set.entries()]);
|
|
assertEquals([1,2,3], [...set]);
|
|
assertEquals([1,2,3], [...set.keys()]);
|
|
assertEquals([1,2,3], [...set.values()]);
|
|
assertEquals([], [...iterator]);
|