Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: fe316088fa6f62b9eb38ae6de2144dd1fd1fdaaf
https://github.com/WebKit/WebKit/commit/fe316088fa6f62b9eb38ae6de2144dd1fd1fdaaf
Author: Sosuke Suzuki <[email protected]>
Date: 2024-10-13 (Sun, 13 Oct 2024)
Changed paths:
M Source/JavaScriptCore/builtins/AsyncFromSyncIteratorPrototype.js
M Source/JavaScriptCore/bytecode/BytecodeIntrinsicRegistry.h
M Source/JavaScriptCore/bytecompiler/BytecodeGenerator.h
M Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp
M Source/JavaScriptCore/runtime/JSAsyncFromSyncIteratorInlines.h
M Source/JavaScriptCore/runtime/JSType.cpp
M Source/JavaScriptCore/runtime/JSType.h
Log Message:
-----------
[JSC] Assert `AsyncFromSyncIterator` before access to internal field
https://bugs.webkit.org/show_bug.cgi?id=280946
Reviewed by Yusuke Suzuki.
The patch at https://commits.webkit.org/283311@main introduced internal fields
to
`AsyncFromSyncIterator`.
This patch changes the functions in `AsyncFromSyncIteratorPrototype` to assert
that the `this`
object is an `AsyncFromSyncIterator` before accessing its internal fields. No
runtime checks are
required.
* Source/JavaScriptCore/builtins/AsyncFromSyncIteratorPrototype.js:
(return):
(throw):
* Source/JavaScriptCore/bytecode/BytecodeIntrinsicRegistry.h:
* Source/JavaScriptCore/bytecompiler/BytecodeGenerator.h:
(JSC::BytecodeGenerator::emitIsAsyncFromSyncIterator):
* Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp:
* Source/JavaScriptCore/runtime/JSAsyncFromSyncIteratorInlines.h:
(JSC::JSAsyncFromSyncIterator::createStructure):
* Source/JavaScriptCore/runtime/JSType.cpp:
(WTF::printInternal):
* Source/JavaScriptCore/runtime/JSType.h:
Canonical link: https://commits.webkit.org/285086@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
