[builtins] HasOnlySimpleElements is false for non-JSObjects

Liedtke · V8 LUCI CQ · commit cc05792346fb · 2024-05-10T09:27:31.000Z
Bug: 338908243 Change-Id: I91139167fb186d56db1695a05e0173069c6c195b Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5529235 Auto-Submit: Matthias Liedtke <mliedtke@chromium.org> Commit-Queue: Jakob Kummerow <jkummerow@chromium.org> Commit-Queue: Matthias Liedtke <mliedtke@chromium.org> Reviewed-by: Jakob Kummerow <jkummerow@chromium.org> Cr-Commit-Position: refs/heads/main@{#93820}
diff --git a/src/builtins/builtins-array.cc b/src/builtins/builtins-array.cc
@@ -51,7 +51,7 @@ inline bool HasOnlySimpleElements(Isolate* isolate,
   DisallowGarbageCollection no_gc;
   PrototypeIterator iter(isolate, receiver, kStartAtReceiver);
   for (; !iter.IsAtEnd(); iter.Advance()) {
-    if (IsJSProxy(iter.GetCurrent())) return false;
+    if (!IsJSObject(iter.GetCurrent())) return false;
     Tagged<JSObject> current = iter.GetCurrent<JSObject>();
     if (!HasSimpleElements(current)) return false;
   }

Original file line number	Diff line number	Diff line change
`@@ -51,7 +51,7 @@ inline bool HasOnlySimpleElements(Isolate* isolate,`
`51`	`51`	`DisallowGarbageCollection no_gc;`
`52`	`52`	`PrototypeIterator iter(isolate, receiver, kStartAtReceiver);`
`53`	`53`	`for (; !iter.IsAtEnd(); iter.Advance()) {`
`54`		`- if (IsJSProxy(iter.GetCurrent())) return false;`
	`54`	`+ if (!IsJSObject(iter.GetCurrent())) return false;`
`55`	`55`	`Tagged<JSObject> current = iter.GetCurrent<JSObject>();`
`56`	`56`	`if (!HasSimpleElements(current)) return false;`
`57`	`57`	`}`