Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 06df73142fede7a42c9675c12b83ef117be6c3a6
https://github.com/WebKit/WebKit/commit/06df73142fede7a42c9675c12b83ef117be6c3a6
Author: Chris Dumez <[email protected]>
Date: 2026-07-13 (Mon, 13 Jul 2026)
Changed paths:
M Source/WebCore/bindings/scripts/CodeGeneratorJS.pm
M Source/WebCore/bindings/scripts/test/JS/JSTestAsyncIterable.cpp
M Source/WebCore/bindings/scripts/test/TestAsyncIterable.idl
Log Message:
-----------
[Bindings] Async-iterable argument conversions reference a nonexistent
castedThis
https://bugs.webkit.org/show_bug.cgi?id=319235
Reviewed by Darin Adler.
The generated values/keys/entries "...Caller" function for an async iterable
takes its this-pointer as a parameter named `thisObject`. However, when the
async iterable declares arguments, GenerateArgumentConversions emitted their
conversions using `*castedThis` (the hardcoded this-object reference passed to
JSValueToNative) and `*castedThis->realm()` (the global-object reference set up
in the async-iterable path). Neither `castedThis` exists in that scope -- only
`thisObject` does -- so any async iterable whose argument conversion actually
references the this-object or the realm would emit C++ that fails to compile.
Only certain argument types thread those references (see
JSValueToNativeDOMConvertNeedsThisObject / NeedsGlobalObject): EventListener
emits the this-object reference, and callback interfaces, callback functions,
ScheduledAction, and records with such value types emit the global-object
reference. The one existing async-iterable test used `optional TestNode?
option`, which needs neither, so the broken emission was latent and never
exercised in-tree.
Fix it by threading the correct this-object reference through
GenerateArgumentConversions. The subroutine gains a trailing
$thisObjectReference
parameter that defaults to "*castedThis", so the normal operation caller is
unchanged; the async-iterable caller passes "*thisObject" and uses
"*thisObject->realm()" for its global-object reference, matching the emitted
parameter name.
To cover this, TestAsyncIterable.idl now declares an async iterable with a
callback-interface argument and an EventListener argument (plus the existing
optional argument), which exercises both the global-object and this-object
reference emission sites. Before this change the regenerated
JSTestAsyncIterable.cpp referenced `*castedThis` / `*castedThis->realm()` inside
a function whose parameter is `thisObject`; after it, both correctly use
`*thisObject` / `*thisObject->realm()`.
* Source/WebCore/bindings/scripts/CodeGeneratorJS.pm:
(GenerateArgumentConversions):
(GenerateGenericIterableDefinition):
* Source/WebCore/bindings/scripts/test/JS/JSTestAsyncIterable.cpp:
(WebCore::jsTestAsyncIterablePrototypeFunction_valuesCaller):
* Source/WebCore/bindings/scripts/test/TestAsyncIterable.idl:
Canonical link: https://commits.webkit.org/317096@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
