Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: b67282ad890b3a3f6306a0d11e81549167f14e39
https://github.com/WebKit/WebKit/commit/b67282ad890b3a3f6306a0d11e81549167f14e39
Author: Sosuke Suzuki <[email protected]>
Date: 2026-05-31 (Sun, 31 May 2026)
Changed paths:
A JSTests/stress/iterator-helpers-set-entries-exception-check.js
M Source/JavaScriptCore/runtime/IteratorOperations.h
Log Message:
-----------
[JSC] Missing exception check in `forEachInIteratorProtocol` Set iterator
fast path
https://bugs.webkit.org/show_bug.cgi?id=315924
Reviewed by Yusuke Suzuki.
JSSetIterator::next() can throw an exception because constructArrayPair
can OOM when the iteration kind is Entries. The Set-iterator fast path
in forEachInIteratorProtocol added in 314169@main was missing the
exception check between next() and the user callback, so the callback
could run with a pending exception. Add the same exception checks the
Map-iterator path already has, making both branches consistent.
Test: JSTests/stress/iterator-helpers-set-entries-exception-check.js
* JSTests/stress/iterator-helpers-set-entries-exception-check.js: Added.
(shouldBe):
(throw.new.Error.set entries):
(const.callback):
(const.set new):
(const.result.set entries):
(set entries):
(throw.new.Error.const.set new):
(throw.new.Error):
* Source/JavaScriptCore/runtime/IteratorOperations.h:
(JSC::forEachInIteratorProtocol):
Canonical link: https://commits.webkit.org/314249@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
