@@ -1083,6 +1083,9 @@ bool IterateElements(Isolate* isolate, Handle<JSReceiver> receiver,
1083
1083
case HOLEY_SEALED_ELEMENTS:
1084
1084
case HOLEY_NONEXTENSIBLE_ELEMENTS:
1085
1085
case HOLEY_ELEMENTS: {
1086
+ // Disallow execution so the cached elements won't change mid execution.
1087
+ DisallowJavascriptExecution no_js (isolate);
1088
+
1086
1089
// Run through the elements FixedArray and use HasElement and GetElement
1087
1090
// to check the prototype for missing elements.
1088
1091
Handle <FixedArray> elements (FixedArray::cast (array->elements ()), isolate);
@@ -1109,6 +1112,9 @@ bool IterateElements(Isolate* isolate, Handle<JSReceiver> receiver,
1109
1112
}
1110
1113
case HOLEY_DOUBLE_ELEMENTS:
1111
1114
case PACKED_DOUBLE_ELEMENTS: {
1115
+ // Disallow execution so the cached elements won't change mid execution.
1116
+ DisallowJavascriptExecution no_js (isolate);
1117
+
1112
1118
// Empty array is FixedArray but not FixedDoubleArray.
1113
1119
if (length == 0 ) break ;
1114
1120
// Run through the elements FixedArray and use HasElement and GetElement
@@ -1145,6 +1151,9 @@ bool IterateElements(Isolate* isolate, Handle<JSReceiver> receiver,
1145
1151
}
1146
1152
1147
1153
case DICTIONARY_ELEMENTS: {
1154
+ // Disallow execution so the cached dictionary won't change mid execution.
1155
+ DisallowJavascriptExecution no_js (isolate);
1156
+
1148
1157
Handle <NumberDictionary> dict (array->element_dictionary (), isolate);
1149
1158
std::vector<uint32_t > indices;
1150
1159
indices.reserve (dict->Capacity () / 2 );
0 commit comments