Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 4a2e724d6789f60954f5b3be90dc907f76625b19
https://github.com/WebKit/WebKit/commit/4a2e724d6789f60954f5b3be90dc907f76625b19
Author: Sosuke Suzuki <[email protected]>
Date: 2026-08-01 (Sat, 01 Aug 2026)
Changed paths:
A JSTests/stress/array-from-set-iterator-symbol-iterator-override.js
M Source/JavaScriptCore/runtime/JSGlobalObject.cpp
M Source/JavaScriptCore/runtime/SetIteratorPrototypeInlines.h
Log Message:
-----------
[JSC] `Array.from(set.keys()/.values())` fast path ignores `Symbol.iterator`
overrides
https://bugs.webkit.org/show_bug.cgi?id=320748
Reviewed by Yusuke Suzuki.
318251@main wired JSSetIteratorType into @arrayFromFastWithoutMapFn, which runs
before Array.from reads items[@@iterator], but the Set-side guards were never
brought up to par with the Map-side ones from 315554@main:
setIteratorProtocolIsFastAndNonObservable ignores an own @@iterator on the
iterator, and m_setIteratorProtocolWatchpointSet does not watch @@iterator on
%SetIteratorPrototype% or %IteratorPrototype%. Mirror the Map guard and
watchpoints so any @@iterator override disables the fast path.
Test: JSTests/stress/array-from-set-iterator-symbol-iterator-override.js
* JSTests/stress/array-from-set-iterator-symbol-iterator-override.js: Added.
(shouldBe):
(shouldBeArray):
(3.values):
* Source/JavaScriptCore/runtime/JSGlobalObject.cpp:
(JSC::JSGlobalObject::init):
* Source/JavaScriptCore/runtime/SetIteratorPrototypeInlines.h:
(JSC::setIteratorProtocolIsFastAndNonObservable):
Canonical link: https://commits.webkit.org/318374@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
