Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: f2f2c2ddf6371b6238958865ea46cff6c97a1661
https://github.com/WebKit/WebKit/commit/f2f2c2ddf6371b6238958865ea46cff6c97a1661
Author: Yusuke Suzuki <[email protected]>
Date: 2026-08-01 (Sat, 01 Aug 2026)
Changed paths:
M JSTests/stress/regress-191731.js
A JSTests/stress/string-conversion-recursion.js
M JSTests/wasm/v8/regress/regress-769846.js
M LayoutTests/imported/w3c/IndexedDB-private-browsing/keypath-expected.txt
M LayoutTests/imported/w3c/IndexedDB-private-browsing/keypath.html
M
LayoutTests/imported/w3c/web-platform-tests/IndexedDB/keypath.any-expected.txt
M LayoutTests/imported/w3c/web-platform-tests/IndexedDB/keypath.any.js
M
LayoutTests/imported/w3c/web-platform-tests/IndexedDB/keypath.any.serviceworker-expected.txt
M
LayoutTests/imported/w3c/web-platform-tests/IndexedDB/keypath.any.sharedworker-expected.txt
M
LayoutTests/imported/w3c/web-platform-tests/IndexedDB/keypath.any.worker-expected.txt
M LayoutTests/js/array-string-recursion-expected.txt
M LayoutTests/js/array-tostring-and-join-expected.txt
M LayoutTests/js/dom/cyclic-ref-toString-expected.txt
M LayoutTests/js/dom/script-tests/cyclic-ref-toString.js
M LayoutTests/js/kde/crash-1-expected.txt
M LayoutTests/js/script-tests/array-string-recursion.js
M LayoutTests/js/script-tests/array-tostring-and-join.js
M LayoutTests/js/script-tests/toString-recursion.js
M LayoutTests/js/toString-recursion-expected.txt
M Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj
M Source/JavaScriptCore/Sources.txt
M Source/JavaScriptCore/runtime/ArrayPrototype.cpp
M Source/JavaScriptCore/runtime/ArrayPrototypeInlines.h
M Source/JavaScriptCore/runtime/ErrorPrototype.cpp
M Source/JavaScriptCore/runtime/JSArray.cpp
M Source/JavaScriptCore/runtime/RegExpPrototype.cpp
R Source/JavaScriptCore/runtime/StringRecursionChecker.cpp
R Source/JavaScriptCore/runtime/StringRecursionChecker.h
M Source/JavaScriptCore/runtime/VM.h
Log Message:
-----------
[JSC] Remove StringRecursionChecker
https://bugs.webkit.org/show_bug.cgi?id=320820
rdar://183831879
Reviewed by Justin Michaud.
StringRecursionChecker behavior is not specified in the spec, and rather
causing many random weird behavior. For example, array.join should
finish even if we are using a recursion if we have some getter which
breaks the cycle in the middle. But it does not happen and showing
incorrect behavior.
Let's just focus on stack overflow instead of adding StringRecursionChecker
checks which is incorrect in terms of the spec. This patch removes
StringRecursionChecker. Most of functions are fine as it is
automatically doing error checks through JS -> C++ calls. But some are
not. In those places, we insert stack overflow check and throwing an
error when it is happening.
Also WPT is having a wrong test which relies on non-specified behavior.
This patch fixes it, and upstreaming a change[1].
[1]: https://github.com/web-platform-tests/wpt/pull/61678
Test: JSTests/stress/string-conversion-recursion.js
* JSTests/stress/regress-191731.js:
* JSTests/stress/string-conversion-recursion.js: Added.
(shouldBe):
(shouldThrowRangeError):
(shouldThrowRangeError.get return):
(array.0.toString):
(shouldBe.array.join):
(new.Error):
* JSTests/wasm/v8/regress/regress-769846.js:
(catch):
* LayoutTests/imported/w3c/IndexedDB-private-browsing/keypath-expected.txt:
* LayoutTests/imported/w3c/IndexedDB-private-browsing/keypath.html:
*
LayoutTests/imported/w3c/web-platform-tests/IndexedDB/keypath.any-expected.txt:
* LayoutTests/imported/w3c/web-platform-tests/IndexedDB/keypath.any.js:
(indexeddb_test):
*
LayoutTests/imported/w3c/web-platform-tests/IndexedDB/keypath.any.serviceworker-expected.txt:
*
LayoutTests/imported/w3c/web-platform-tests/IndexedDB/keypath.any.sharedworker-expected.txt:
*
LayoutTests/imported/w3c/web-platform-tests/IndexedDB/keypath.any.worker-expected.txt:
* LayoutTests/js/array-string-recursion-expected.txt:
* LayoutTests/js/array-tostring-and-join-expected.txt:
* LayoutTests/js/dom/cyclic-ref-toString-expected.txt:
* LayoutTests/js/dom/script-tests/cyclic-ref-toString.js:
* LayoutTests/js/kde/crash-1-expected.txt:
* LayoutTests/js/script-tests/array-string-recursion.js:
(catch):
* LayoutTests/js/script-tests/array-tostring-and-join.js:
(Object.prototype.toString):
(plain.toString):
(obj.__proto__.toString): Deleted.
* LayoutTests/js/script-tests/toString-recursion.js:
* LayoutTests/js/toString-recursion-expected.txt:
* Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj:
* Source/JavaScriptCore/Sources.txt:
* Source/JavaScriptCore/runtime/ArrayPrototype.cpp:
(JSC::JSC_DEFINE_HOST_FUNCTION):
* Source/JavaScriptCore/runtime/ArrayPrototypeInlines.h:
* Source/JavaScriptCore/runtime/ErrorPrototype.cpp:
(JSC::JSC_DEFINE_HOST_FUNCTION):
* Source/JavaScriptCore/runtime/JSArray.cpp:
(JSC::JSArray::fastToString):
* Source/JavaScriptCore/runtime/RegExpPrototype.cpp:
(JSC::JSC_DEFINE_HOST_FUNCTION):
* Source/JavaScriptCore/runtime/StringRecursionChecker.cpp: Removed.
* Source/JavaScriptCore/runtime/StringRecursionChecker.h: Removed.
* Source/JavaScriptCore/runtime/VM.h:
Canonical link: https://commits.webkit.org/318399@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
