72d8307f78
If a species constructor is installed, filter() needs to loop over the elements of the array in the "slow" way, because it doesn't know the ElementsKind of the output array. The code failed to bail out to the slow case for the loop right away on discovering this. Bug: chromium:920184, chromium:920491 Change-Id: I74496db20a90807b631c1bebe7604d85b199df67 Reviewed-on: https://chromium-review.googlesource.com/c/1405035 Reviewed-by: Michael Starzinger <mstarzinger@chromium.org> Commit-Queue: Michael Stanton <mvstanton@chromium.org> Cr-Commit-Position: refs/heads/master@{#58713}
15 lines
386 B
JavaScript
15 lines
386 B
JavaScript
// Copyright 2019 the V8 project authors. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style license that can be
|
|
// found in the LICENSE file.
|
|
|
|
// Flags: --verify-heap --enable-slow-asserts
|
|
|
|
var Ctor = function() {
|
|
return [];
|
|
};
|
|
var a = ["one", "two", "three"];
|
|
a.constructor = {};
|
|
a.constructor[Symbol.species] = Ctor;
|
|
|
|
a.filter(function() { return true; });
|