| Index: src/objects.cc
|
| diff --git a/src/objects.cc b/src/objects.cc
|
| index 9f824fbf482bd73fb0769625fec091a2d78b6019..818df0853ac494c1ce3b29631f4915d5c122680a 100644
|
| --- a/src/objects.cc
|
| +++ b/src/objects.cc
|
| @@ -2177,31 +2177,36 @@ MaybeHandle<Object> Object::ArraySpeciesConstructor(
|
| }
|
|
|
| bool Object::IterationHasObservableEffects() {
|
| - if (IsJSArray()) {
|
| - // Check that the spread arg has fast elements
|
| - JSArray* spread_array = JSArray::cast(this);
|
| - ElementsKind array_kind = spread_array->GetElementsKind();
|
| - Isolate* isolate = spread_array->GetIsolate();
|
| -
|
| - // And that it has the orignal ArrayPrototype
|
| - JSObject* array_proto = JSObject::cast(spread_array->map()->prototype());
|
| - Map* iterator_map = isolate->initial_array_iterator_prototype()->map();
|
| -
|
| - // Check that the iterator acts as expected.
|
| - // If IsArrayIteratorLookupChainIntact(), then we know that the initial
|
| - // ArrayIterator is being used. If the map of the prototype has changed,
|
| - // then take the slow path.
|
| - if (isolate->is_initial_array_prototype(array_proto) &&
|
| - isolate->IsArrayIteratorLookupChainIntact() &&
|
| - isolate->is_initial_array_iterator_prototype_map(iterator_map)) {
|
| - if (IsFastPackedElementsKind(array_kind)) {
|
| - return false;
|
| - }
|
| - if (IsFastHoleyElementsKind(array_kind) &&
|
| - isolate->IsFastArrayConstructorPrototypeChainIntact()) {
|
| - return false;
|
| - }
|
| - }
|
| + // Check that this object is an array.
|
| + if (!IsJSArray()) return true;
|
| + JSArray* spread_array = JSArray::cast(this);
|
| + Isolate* isolate = spread_array->GetIsolate();
|
| +
|
| + // Check that we have the original ArrayPrototype.
|
| + JSObject* array_proto = JSObject::cast(spread_array->map()->prototype());
|
| + if (!isolate->is_initial_array_prototype(array_proto)) return true;
|
| +
|
| + // Check that the ArrayPrototype hasn't been modified in a way that would
|
| + // affect iteration.
|
| + if (!isolate->IsArrayIteratorLookupChainIntact()) return true;
|
| +
|
| + // Check that the map of the initial array iterator hasn't changed.
|
| + Map* iterator_map = isolate->initial_array_iterator_prototype()->map();
|
| + if (!isolate->is_initial_array_iterator_prototype_map(iterator_map)) {
|
| + return true;
|
| + }
|
| +
|
| + // For FastPacked kinds, iteration will have the same effect as simply
|
| + // accessing each property in order.
|
| + ElementsKind array_kind = spread_array->GetElementsKind();
|
| + if (IsFastPackedElementsKind(array_kind)) return false;
|
| +
|
| + // For FastHoley kinds, an element access on a hole would cause a lookup on
|
| + // the prototype. This could have different results if the prototype has been
|
| + // changed.
|
| + if (IsFastHoleyElementsKind(array_kind) &&
|
| + isolate->IsFastArrayConstructorPrototypeChainIntact()) {
|
| + return false;
|
| }
|
| return true;
|
| }
|
|
|