Disallow subclassing Arrays.

src/runtime/runtime-classes.cc

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include <stdlib.h>
 #include <limits>
 
 #include "src/v8.h"
 
 #include "src/isolate-inl.h"
@@ skipping 29 matching lines @@
 
 RUNTIME_FUNCTION(Runtime_ThrowConstructorNonCallableError) {
   HandleScope scope(isolate);
   DCHECK(args.length() == 0);
   THROW_NEW_ERROR_RETURN_FAILURE(
       isolate,
       NewTypeError("constructor_noncallable", HandleVector<Object>(NULL, 0)));
 }
 
 
+RUNTIME_FUNCTION(Runtime_ThrowArrayNotSubclassableError) {
+  HandleScope scope(isolate);
+  DCHECK(args.length() == 0);
+  THROW_NEW_ERROR_RETURN_FAILURE(
+      isolate,
+      NewTypeError("array_not_subclassable", HandleVector<Object>(NULL, 0)));
+}
+
+
 RUNTIME_FUNCTION(Runtime_ToMethod) {
   HandleScope scope(isolate);
   DCHECK(args.length() == 2);
   CONVERT_ARG_HANDLE_CHECKED(JSFunction, fun, 0);
   CONVERT_ARG_HANDLE_CHECKED(JSObject, home_object, 1);
   Handle<JSFunction> clone = JSFunction::CloneClosure(fun);
   Handle<Symbol> home_object_symbol(isolate->heap()->home_object_symbol());
   JSObject::SetOwnPropertyIgnoreAttributes(clone, home_object_symbol,
                                            home_object, DONT_ENUM).Assert();
   return *clone;
@@ skipping 359 matching lines @@
   return *isolate->factory()->undefined_value();
 }
 
 
 RUNTIME_FUNCTION(RuntimeReference_DefaultConstructorCallSuper) {
   UNREACHABLE();
   return nullptr;
 }
 }
 }  // namespace v8::internal