• Hai Dang's avatar
    Add iterator protectors for JSMapIterator/JSSet/JSSetIterator. · 60d3ce72
    Hai Dang authored
    The MapIterator protector protects the original iteration behaviors of
    Map.prototype.keys(), Map.prototype.values(), and Set.prototype.entries().
    It does not protect the original iteration behavior of
    Map.prototype[Symbol.iterator](). The protector is invalidated when:
    * The 'next' property is set on an object where the property holder is the
      %MapIteratorPrototype% (e.g. because the object is that very prototype).
    * The 'Symbol.iterator' property is set on an object where the property
      holder is the %IteratorPrototype%. Note that this also invalidates the
      SetIterator protector (see below).
    
    The SetIterator protector protects the original iteration behavior of
    Set.prototype.keys(), Set.prototype.values(), Set.prototype.entries(),
    and Set.prototype[Symbol.iterator](). The protector is invalidated when:
    * The 'next' property is set on an object where the property holder is the
      %SetIteratorPrototype% (e.g. because the object is that very prototype).
    * The 'Symbol.iterator' property is set on an object where the property
      holder is the %SetPrototype% OR %IteratorPrototype%. This means that
      setting Symbol.iterator on a MapIterator object can also invalidate the
      SetIterator protector, and vice versa, setting Symbol.iterator on a
      SetIterator object can also invalidate the MapIterator. This is an over-
      approximation for the sake of simplicity.
    
    Bug: v8:7980
    Change-Id: I54ad6e4c7f19ccc27d7001f6c4b6c8d6ea4ee871
    Reviewed-on: https://chromium-review.googlesource.com/c/1273102Reviewed-by: 's avatarGeorg Neis <neis@chromium.org>
    Reviewed-by: 's avatarUlan Degenbaev <ulan@chromium.org>
    Reviewed-by: 's avatarBenedikt Meurer <bmeurer@chromium.org>
    Commit-Queue: Hai Dang <dhai@google.com>
    Cr-Commit-Position: refs/heads/master@{#56530}
    60d3ce72
isolate.h 76 KB