[builtins] fix Object.fromEntries fast-path

Bug: chromium:1272026 Change-Id: Ic569c61b21d4c9c95d62e731a48076c871dd74ec Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3303804 Reviewed-by: Marja Hölttä <[email protected]> Commit-Queue: Tobias Tebbi <[email protected]> Cr-Commit-Position: refs/heads/main@{#78119}
riscv-collab · Nov 29, 2021 · bfaa4b2 · bfaa4b2
1 parent 426eda0
commit bfaa4b2
Show file tree

Hide file tree

Showing 2 changed files with 15 additions and 4 deletions.
diff --git a/src/builtins/collections.tq b/src/builtins/collections.tq
@@ -33,12 +33,9 @@ macro LoadKeyValuePairNoSideEffects(implicit context: Context)(o: JSAny):
         }
       }
     }
-    case (JSReceiver): {
+    case (JSAny): {
       goto MayHaveSideEffects;
     }
-    case (o: JSAny): deferred {
-      ThrowTypeError(MessageTemplate::kIteratorValueNotAnObject, o);
-    }
   }
 }
 
@@ -48,6 +45,8 @@ transitioning macro LoadKeyValuePair(implicit context: Context)(o: JSAny):
   try {
     return LoadKeyValuePairNoSideEffects(o) otherwise Generic;
   } label Generic {
+    const o = Cast<JSReceiver>(o)
+        otherwise ThrowTypeError(MessageTemplate::kIteratorValueNotAnObject, o);
     return KeyValuePair{
       key: GetProperty(o, Convert<Smi>(0)),
       value: GetProperty(o, Convert<Smi>(1))

diff --git a/test/mjsunit/regress/regress-crbug-1272026.js b/test/mjsunit/regress/regress-crbug-1272026.js
@@ -0,0 +1,12 @@
+// Copyright 2021 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+let calledReturn = false;
+Object.prototype.return = function () {
+  calledReturn = true;
+};
+try {
+  Object.fromEntries([0]);
+} catch(e) {}
+assertEquals(true, calledReturn);