1 // Copyright 2016 the V8 project authors. All rights reserved. 2 // Use of this source code is governed by a BSD-style license that can be 3 // found in the LICENSE file. 4 5 // Flags: --allow-natives-syntax 6 7 // Overwriting the constructor of an instance updates the protector 8 9 let x = []; 10 11 assertEquals(Array, x.map(()=>{}).constructor); 12 assertEquals(Array, x.filter(()=>{}).constructor); 13 assertEquals(Array, x.slice().constructor); 14 assertEquals(Array, x.splice().constructor); 15 assertEquals(Array, x.concat([1]).constructor); 16 assertEquals(1, x.concat([1])[0]); 17 18 class MyArray extends Array { } 19 20 Object.defineProperty(x, 'constructor', {get() { return MyArray; }}); 21 assertFalse(%SpeciesProtector()); 22 23 assertEquals(MyArray, x.map(()=>{}).constructor); 24 assertEquals(MyArray, x.filter(()=>{}).constructor); 25 assertEquals(MyArray, x.slice().constructor); 26 assertEquals(MyArray, x.splice().constructor); 27 assertEquals(MyArray, x.concat([1]).constructor); 28 assertEquals(1, x.concat([1])[0]); 29
