1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
|
// |jit-test|
function f(x) {
let [a, b, c] = x;
return a + b + c;
}
function intact(name) {
let state = getFuseState();
if (!(name in state)) {
throw "No such fuse " + name;
}
return state[name].intact
}
let didIt = false;
([])[Symbol.iterator]().__proto__['return'] = () => { didIt = true; return { done: true, value: undefined } };
assertEq(intact("ArrayIteratorPrototypeHasNoReturnProperty"), false);
assertEq(f([1, 2, 3, 0]), 6);
assertEq(didIt, true);
didIt = false;
g = newGlobal();
g.evaluate(f.toString());
// Passing in an array from this realm should mean that the return is triggered.
g.long = [1, 2, 3, 0];
g.evaluate("assertEq(f(long),6)")
g.evaluate(intact.toString());
// ensure fuse isn't popped inside g.
g.evaluate(`assertEq(intact("ArrayIteratorPrototypeHasNoReturnProperty"), true)`)
assertEq(didIt, true);
didIt = false;
g = newGlobal();
g.evaluate(f.toString());
// Passing in an array from this realm should mean that the return is triggered.
g.long = [1, 2, 3, 0];
// Warm up this global's f.
g.evaluate(`
for (let i = 0; i < 100; i++) {
assertEq(f([1, 2, 3, 0]), 6);
}
`);
assertEq(didIt, false);
g.evaluate("assertEq(f(long), 6)");
assertEq(didIt, true);
delete Array.prototype[Symbol.iterator]
let success = false;
try { f([1, 2, 3, 4]); success = true } catch (e) { }
assertEq(success, false);
try { g.evaluate("assertEq(f(long), 6)"); success = true } catch (e) { }
assertEq(success, false);
|
