1 files changed, 21 insertions, 6 deletions

diff --git a/deps/v8/src/lookup.cc b/deps/v8/src/lookup.cc
index fb3d1263d7..c6cc06eeae 100644
--- a/deps/v8/src/lookup.cc
+++ b/deps/v8/src/lookup.cc
@@ -323,12 +323,19 @@ void LookupIterator::InternalUpdateProtector() {
       }
     }
   } else if (*name_ == roots.next_string()) {
-    if (!isolate_->IsArrayIteratorLookupChainIntact()) return;
-    // Setting the next property of %ArrayIteratorPrototype% also needs to
-    // invalidate the array iterator protector.
     if (isolate_->IsInAnyContext(
             *holder_, Context::INITIAL_ARRAY_ITERATOR_PROTOTYPE_INDEX)) {
+      // Setting the next property of %ArrayIteratorPrototype% also needs to
+      // invalidate the array iterator protector.
+      if (!isolate_->IsArrayIteratorLookupChainIntact()) return;
       isolate_->InvalidateArrayIteratorProtector();
+    } else if (isolate_->IsInAnyContext(
+                   *receiver_,
+                   Context::INITIAL_STRING_ITERATOR_PROTOTYPE_INDEX)) {
+      // Setting the next property of %StringIteratorPrototype% invalidates the
+      // string iterator protector.
+      if (!isolate_->IsStringIteratorLookupChainIntact()) return;
+      isolate_->InvalidateStringIteratorProtector();
     }
   } else if (*name_ == roots.species_symbol()) {
     if (!isolate_->IsArraySpeciesLookupChainIntact() &&
@@ -354,9 +361,17 @@ void LookupIterator::InternalUpdateProtector() {
     if (!isolate_->IsIsConcatSpreadableLookupChainIntact()) return;
     isolate_->InvalidateIsConcatSpreadableProtector();
   } else if (*name_ == roots.iterator_symbol()) {
-    if (!isolate_->IsArrayIteratorLookupChainIntact()) return;
     if (holder_->IsJSArray()) {
+      if (!isolate_->IsArrayIteratorLookupChainIntact()) return;
       isolate_->InvalidateArrayIteratorProtector();
+    } else if (isolate_->IsInAnyContext(
+                   *receiver_, Context::INITIAL_STRING_PROTOTYPE_INDEX)) {
+      // Setting the Symbol.iterator property of String.prototype invalidates
+      // the string iterator protector. Symbol.iterator can also be set on a
+      // String wrapper, but not on a primitive string. We only support
+      // protector for primitive strings.
+      if (!isolate_->IsStringIteratorLookupChainIntact()) return;
+      isolate_->InvalidateStringIteratorProtector();
     }
   } else if (*name_ == roots.resolve_string()) {
     if (!isolate_->IsPromiseResolveLookupChainIntact()) return;
@@ -535,7 +550,7 @@ void LookupIterator::ReconfigureDataProperty(Handle<Object> value,
 // via a trap. Adding properties to primitive values is not observable.
 void LookupIterator::PrepareTransitionToDataProperty(
     Handle<JSReceiver> receiver, Handle<Object> value,
-    PropertyAttributes attributes, Object::StoreFromKeyed store_mode) {
+    PropertyAttributes attributes, StoreOrigin store_origin) {
   DCHECK_IMPLIES(receiver->IsJSProxy(), name()->IsPrivate());
   DCHECK(receiver.is_identical_to(GetStoreTarget<JSReceiver>()));
   if (state_ == TRANSITION) return;
@@ -589,7 +604,7 @@ void LookupIterator::PrepareTransitionToDataProperty(
 
   Handle<Map> transition =
       Map::TransitionToDataProperty(isolate_, map, name_, value, attributes,
-                                    kDefaultFieldConstness, store_mode);
+                                    kDefaultFieldConstness, store_origin);
   state_ = TRANSITION;
   transition_ = transition;