Fixing Sloppy Symbol.iterator setter

test/mjsunit/es6/arguments-iterator.js

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Flags: --allow-natives-syntax
 
 
 // Note in general that "arguments.foo" and "var o = arguments; o.foo"
 // are treated differently by full-codegen, and so both cases need to be
 // tested.
@@ skipping 142 matching lines @@
   for (var entry of arguments) {
     assertEquals([i, arguments[i]], entry);
     i++;
   }
 
   assertEquals(arguments.length, i);
 }
 TestAssignmentToIterator(1, 2, 3, 4, 5);
 
 
+// Regression test for crbug.com/521484.
+function TestAssignmentToIterator2() {
+  var i = 0;
+  arguments.__defineGetter__('callee', function(){});
+  arguments.__defineGetter__('length', function(){ return 1 });
+  arguments[Symbol.iterator] = [].entries;
+  for (var entry of arguments) {
+    assertEquals([i, arguments[i]], entry);
+    i++;
+  }
+
+  assertEquals(arguments.length, i);
+}
+TestAssignmentToIterator2(1, 2, 3, 4, 5);
+
 function TestArgumentsMutation() {
   var i = 0;
   for (var x of arguments) {
     assertEquals(arguments[i], x);
     arguments[i+1] *= 2;
     i++;
   }
 
   assertEquals(arguments.length, i);
 }
@@ skipping 45 matching lines @@
   o = Object.freeze({__proto__:arguments});
   assertSame([][Symbol.iterator], o[Symbol.iterator]);
   assertFalse(o.hasOwnProperty(Symbol.iterator));
   assertSame([][Symbol.iterator], o[Symbol.iterator]);
   assertThrows(function () { o[Symbol.iterator] = 10 });
   assertFalse(o.hasOwnProperty(Symbol.iterator));
   assertEquals([][Symbol.iterator], o[Symbol.iterator]);
   assertSame([][Symbol.iterator], arguments[Symbol.iterator]);
 }
 TestArgumentsAsProto();