Index: src/isolate.cc |
diff --git a/src/isolate.cc b/src/isolate.cc |
index 926b9866d4e019afb8fad2dd811f876e20044449..7a192df957ff63bb25ad531e03af9dd6a9defe90 100644 |
--- a/src/isolate.cc |
+++ b/src/isolate.cc |
@@ -2553,25 +2553,6 @@ bool Isolate::IsFastArrayConstructorPrototypeChainIntact() { |
return cell_reports_intact; |
} |
-bool Isolate::IsArraySpeciesLookupChainIntact() { |
- if (!FLAG_harmony_species) return true; |
- // Note: It would be nice to have debug checks to make sure that the |
- // species protector is accurate, but this would be hard to do for most of |
- // what the protector stands for: |
- // - You'd need to traverse the heap to check that no Array instance has |
- // a constructor property |
- // - To check that Array[Symbol.species] == Array, JS code has to execute, |
- // but JS cannot be invoked in callstack overflow situations |
- // All that could be checked reliably is that |
- // Array.prototype.constructor == Array. Given that limitation, no check is |
- // done here. In place, there are mjsunit tests harmony/array-species* which |
- // ensure that behavior is correct in various invalid protector cases. |
- |
- PropertyCell* species_cell = heap()->species_protector(); |
- return species_cell->value()->IsSmi() && |
- Smi::cast(species_cell->value())->value() == kArrayProtectorValid; |
-} |
- |
void Isolate::InvalidateArraySpeciesProtector() { |
if (!FLAG_harmony_species) return; |
DCHECK(factory()->species_protector()->value()->IsSmi()); |