Revision: 21399
Author: [email protected]
Date: Wed May 21 08:05:11 2014 UTC
Log: Array Iterator next should check for own property
Since we are using private symbols for the internal slots we need to
check for a local property.
BUG=None
LOG=Y
[email protected]
Review URL: https://codereview.chromium.org/268363011
Patch from Erik Arvidsson <[email protected]>.
http://code.google.com/p/v8/source/detail?r=21399
Modified:
/branches/bleeding_edge/src/array-iterator.js
/branches/bleeding_edge/test/mjsunit/harmony/array-iterator.js
=======================================
--- /branches/bleeding_edge/src/array-iterator.js Mon May 12 08:43:01 2014
UTC
+++ /branches/bleeding_edge/src/array-iterator.js Wed May 21 08:05:11 2014
UTC
@@ -38,11 +38,16 @@
// 15.4.5.2.2 ArrayIterator.prototype.next( )
function ArrayIteratorNext() {
var iterator = ToObject(this);
- var array = GET_PRIVATE(iterator, arrayIteratorObjectSymbol);
- if (!array) {
+
+ if (!HAS_PRIVATE(iterator, arrayIteratorObjectSymbol)) {
throw MakeTypeError('incompatible_method_receiver',
['Array Iterator.prototype.next']);
}
+
+ var array = GET_PRIVATE(iterator, arrayIteratorObjectSymbol);
+ if (IS_UNDEFINED(array)) {
+ return CreateIteratorResultObject(UNDEFINED, true);
+ }
var index = GET_PRIVATE(iterator, arrayIteratorNextIndexSymbol);
var itemKind = GET_PRIVATE(iterator, arrayIterationKindSymbol);
@@ -51,17 +56,19 @@
// "sparse" is never used.
if (index >= length) {
- SET_PRIVATE(iterator, arrayIteratorNextIndexSymbol, INFINITY);
+ SET_PRIVATE(iterator, arrayIteratorObjectSymbol, UNDEFINED);
return CreateIteratorResultObject(UNDEFINED, true);
}
SET_PRIVATE(iterator, arrayIteratorNextIndexSymbol, index + 1);
- if (itemKind == ITERATOR_KIND_VALUES)
+ if (itemKind == ITERATOR_KIND_VALUES) {
return CreateIteratorResultObject(array[index], false);
+ }
- if (itemKind == ITERATOR_KIND_ENTRIES)
+ if (itemKind == ITERATOR_KIND_ENTRIES) {
return CreateIteratorResultObject([index, array[index]], false);
+ }
return CreateIteratorResultObject(index, false);
}
=======================================
--- /branches/bleeding_edge/test/mjsunit/harmony/array-iterator.js Fri May
9 16:37:04 2014 UTC
+++ /branches/bleeding_edge/test/mjsunit/harmony/array-iterator.js Wed May
21 08:05:11 2014 UTC
@@ -214,3 +214,15 @@
}
}
TestForArrayEntries();
+
+
+function TestNonOwnSlots() {
+ var array = [0];
+ var iterator = array.values();
+ var object = {__proto__: iterator};
+
+ assertThrows(function() {
+ object.next();
+ }, TypeError);
+}
+TestNonOwnSlots();
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
