Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 5546cde98cd08c8c21a393d978444db7eb9c8918
https://github.com/WebKit/WebKit/commit/5546cde98cd08c8c21a393d978444db7eb9c8918
Author: Sosuke Suzuki <[email protected]>
Date: 2026-06-19 (Fri, 19 Jun 2026)
Changed paths:
A JSTests/stress/array-from-map-iterator-symbol-iterator-override.js
M Source/JavaScriptCore/runtime/JSGlobalObject.cpp
M Source/JavaScriptCore/runtime/MapIteratorPrototypeInlines.h
Log Message:
-----------
[JSC] `Array.from(map.keys())` fast path ignores `Symbol.iterator` overrides
https://bugs.webkit.org/show_bug.cgi?id=317076
Reviewed by Yusuke Suzuki.
Array.from performs GetMethod(items, @@iterator) and iterates whatever that
method returns, but the Array.from(map.keys()) fast path only checks
mapIteratorProtocolIsFastAndNonObservable, a GetIteratorDirect-style guard
that never looks at @@iterator. An own Symbol.iterator on the iterator, one
added to %MapIteratorPrototype%, or a replaced
%Iterator.prototype%[Symbol.iterator] is ignored and the fast path keeps
draining the map iterator directly.
Test: JSTests/stress/array-from-map-iterator-symbol-iterator-override.js
* JSTests/stress/array-from-map-iterator-symbol-iterator-override.js: Added.
(shouldBe):
(shouldBeArray):
(string_appeared_here.keys):
* Source/JavaScriptCore/runtime/ArrayConstructor.cpp:
(JSC::mapIteratorIsIterableFastAndNonObservable):
(JSC::JSC_DEFINE_HOST_FUNCTION):
Canonical link: https://commits.webkit.org/315554@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
