Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 84a71a9868ed742fd639b35b926f10f5d2decf81
https://github.com/WebKit/WebKit/commit/84a71a9868ed742fd639b35b926f10f5d2decf81
Author: Sosuke Suzuki <[email protected]>
Date: 2026-06-08 (Mon, 08 Jun 2026)
Changed paths:
A JSTests/stress/iterator-close-map-set-fast-path-mid-iteration-return.js
M Source/JavaScriptCore/runtime/IteratorOperations.h
Log Message:
-----------
[JSC] Map/Set iteration fast paths should perform `IteratorClose` when the
callback throws
https://bugs.webkit.org/show_bug.cgi?id=316495
Reviewed by Yusuke Suzuki.
The Map/Set iterator fast paths in forEachInIteratorProtocol and the Map/Set
storage fast paths in forEachInIterable returned immediately when the callback
threw, without performing IteratorClose. A "return" method installed during
iteration was therefore never invoked. This was observable e.g. via
Iterator.prototype.forEach over a Map/Set iterator, or via new Map(map) /
new Set(set) with an overridden adder that throws.
Fix it the same way forEachInFastArray already handles this for arrays: on a
callback exception, close the iterator, lazily materializing one positioned
where the iteration stopped in the forEachInIterable case. Set.prototype
methods iterating internal set data keep the old behavior (no IteratorClose),
and the happy path performs no extra allocation.
Test: JSTests/stress/iterator-close-map-set-fast-path-mid-iteration-return.js
* JSTests/stress/iterator-close-map-set-fast-path-mid-iteration-return.js:
Added.
(shouldBe):
(const.setIteratorPrototype.Object.getPrototypeOf.new.Set.Symbol.iterator.try.):
(const.setIteratorPrototype.Object.getPrototypeOf.new.Set.Symbol.iterator):
(shouldBe.try.):
(shouldBe.const.iterator.set values):
(shouldBe.const.set new):
(shouldBe.const.iterator.set keys):
(shouldBe.mapIteratorPrototype.return):
(shouldBe.Map.prototype):
(shouldBe.setIteratorPrototype.return):
(shouldBe.Set.prototype.add):
(shouldBe.set catch):
(shouldBe.iterator.return):
* Source/JavaScriptCore/runtime/IteratorOperations.h:
(JSC::forEachInMapStorage):
(JSC::forEachInSetStorage):
(JSC::forEachInIterable):
(JSC::forEachInIteratorProtocol):
Canonical link: https://commits.webkit.org/314776@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
