c7eb436d09
Flags removed (all begin with "harmony-"): function-name instanceof iterator-close unicode-regexps regexp-exec regexp-subclass species BUG=v8:3566, v8:3648, v8:3699, v8:4093, v8:4447, v8:4602 Review-Url: https://codereview.chromium.org/2096933002 Cr-Commit-Position: refs/heads/master@{#37235}
29 lines
975 B
JavaScript
29 lines
975 B
JavaScript
// Copyright 2016 the V8 project authors. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style license that can be
|
|
// found in the LICENSE file.
|
|
|
|
// Flags: --allow-natives-syntax
|
|
|
|
// Overwriting the constructor of an instance updates the protector
|
|
|
|
let x = [];
|
|
|
|
assertEquals(Array, x.map(()=>{}).constructor);
|
|
assertEquals(Array, x.filter(()=>{}).constructor);
|
|
assertEquals(Array, x.slice().constructor);
|
|
assertEquals(Array, x.splice().constructor);
|
|
assertEquals(Array, x.concat([1]).constructor);
|
|
assertEquals(1, x.concat([1])[0]);
|
|
|
|
class MyArray extends Array { }
|
|
|
|
Object.defineProperty(x, 'constructor', {get() { return MyArray; }});
|
|
assertFalse(%SpeciesProtector());
|
|
|
|
assertEquals(MyArray, x.map(()=>{}).constructor);
|
|
assertEquals(MyArray, x.filter(()=>{}).constructor);
|
|
assertEquals(MyArray, x.slice().constructor);
|
|
assertEquals(MyArray, x.splice().constructor);
|
|
assertEquals(MyArray, x.concat([1]).constructor);
|
|
assertEquals(1, x.concat([1])[0]);
|