Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: b0d53a73d7eb053d4ad8228903d0298f6676459d
https://github.com/WebKit/WebKit/commit/b0d53a73d7eb053d4ad8228903d0298f6676459d
Author: Sosuke Suzuki <[email protected]>
Date: 2026-06-22 (Mon, 22 Jun 2026)
Changed paths:
A JSTests/stress/for-each-in-iterable-cross-realm-iterator-close.js
M Source/JavaScriptCore/runtime/IteratorOperations.h
Log Message:
-----------
[JSC] `IteratorClose` in `forEachInIterable` should use the Map/Set's own
realm's iterator structure
https://bugs.webkit.org/show_bug.cgi?id=317554
Reviewed by Yusuke Suzuki.
When the JSMap/JSSet storage fast paths in forEachInIterable materialize a
temporary iterator for IteratorClose after the callback throws, they were
creating it with the caller realm's
mapIteratorStructure()/setIteratorStructure().
However, the isIteratorProtocolFastAndNonObservable() guard only checks the
Map/Set's own realm, so we can take the fast path with a cross-realm Map/Set
and end up looking up `return` on the wrong realm's %MapIteratorPrototype% /
%SetIteratorPrototype%.
Fix this by creating the materialized iterator with the Map/Set's own realm's
structure, matching what the spec's GetIterator would have produced.
Test: JSTests/stress/for-each-in-iterable-cross-realm-iterator-close.js
* JSTests/stress/for-each-in-iterable-cross-realm-iterator-close.js: Added.
(shouldBe):
(shouldBe.SetIteratorPrototype.return):
(MapIteratorPrototype.return):
* Source/JavaScriptCore/runtime/IteratorOperations.h:
(JSC::forEachInIterable):
Canonical link: https://commits.webkit.org/315645@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
