1// Copyright 2016 the V8 project authors. All rights reserved. 2// Use of this source code is governed by a BSD-style license that can be 3// found in the LICENSE file. 4 5// Flags: --allow-natives-syntax 6 7// Overwriting the constructor of an instance updates the protector 8 9let x = []; 10 11assertEquals(Array, x.map(()=>{}).constructor); 12assertEquals(Array, x.filter(()=>{}).constructor); 13assertEquals(Array, x.slice().constructor); 14assertEquals(Array, x.splice().constructor); 15assertEquals(Array, x.concat([1]).constructor); 16assertEquals(1, x.concat([1])[0]); 17 18class MyArray extends Array { } 19 20Object.prototype[Symbol.species] = MyArray; 21delete Array[Symbol.species]; 22assertFalse(%SpeciesProtector()); 23 24assertEquals(MyArray, x.map(()=>{}).constructor); 25assertEquals(MyArray, x.filter(()=>{}).constructor); 26assertEquals(MyArray, x.slice().constructor); 27assertEquals(MyArray, x.splice().constructor); 28assertEquals(MyArray, x.concat([1]).constructor); 29assertEquals(1, x.concat([1])[0]); 30