Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 87547f94b76e48d4dbc6a550b0f8515a1b2f7936
https://github.com/WebKit/WebKit/commit/87547f94b76e48d4dbc6a550b0f8515a1b2f7936
Author: Sosuke Suzuki <[email protected]>
Date: 2026-05-31 (Sun, 31 May 2026)
Changed paths:
A JSTests/stress/iterator-prototype-forEach-map-set-iterator-close.js
M Source/JavaScriptCore/runtime/JSGlobalObject.cpp
M Source/JavaScriptCore/runtime/MapIteratorPrototypeInlines.h
M Source/JavaScriptCore/runtime/SetIteratorPrototypeInlines.h
Log Message:
-----------
[JSC] Map/Set iterator fast path in `forEachInIteratorProtocol` should
perform IteratorClose when the callback throws
https://bugs.webkit.org/show_bug.cgi?id=315979
Reviewed by Yusuke Suzuki.
The Map/Set iterator fast paths in forEachInIteratorProtocol skip IteratorClose
when the callback throws, so a "return" method installed on the iterator itself
or anywhere on its prototype chain is never invoked.
Fix this by rejecting iterators with an own "return" property in the fast path
guards, and by installing "return" absence watchpoints on
ArrayIterator.prototype,
MapIterator.prototype, SetIterator.prototype, StringIterator.prototype,
Iterator.prototype, and Object.prototype, wired to the corresponding iterator
protocol watchpoint sets. Iterators that are no longer fast and non-observable
go through the generic path, which performs IteratorClose.
Test: JSTests/stress/iterator-prototype-forEach-map-set-iterator-close.js
* JSTests/stress/iterator-prototype-forEach-map-set-iterator-close.js: Added.
(shouldBe):
(iterator.return):
(shouldThrow):
(shouldBe.iterator.return):
(shouldBe.const.iterator.set values):
(const.iterator.set keys):
(const.iterator.set entries):
(const.set new):
(const.iterator.set values):
(const.callback):
(shouldBe.const.set new):
(shouldBe.set values):
(set shouldBe):
* Source/JavaScriptCore/runtime/JSGlobalObject.cpp:
(JSC::JSGlobalObject::init):
* Source/JavaScriptCore/runtime/MapIteratorPrototypeInlines.h:
(JSC::mapIteratorProtocolIsFastAndNonObservable):
* Source/JavaScriptCore/runtime/SetIteratorPrototypeInlines.h:
(JSC::setIteratorProtocolIsFastAndNonObservable):
Canonical link: https://commits.webkit.org/314277@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
