Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 45d9af505efd3b392b6208f7a1ebff0bbd5d125d
https://github.com/WebKit/WebKit/commit/45d9af505efd3b392b6208f7a1ebff0bbd5d125d
Author: Sosuke Suzuki <[email protected]>
Date: 2026-09-27 (Sun, 27 Sep 2026)
Changed paths:
A JSTests/stress/for-of-fast-array-and-iterator-with-known-structure.js
M Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp
Log Message:
-----------
[JSC] DFG asserts on a for-of loop that sees both an Array and a generator
https://bugs.webkit.org/show_bug.cgi?id=325416
Reviewed by Yusuke Suzuki.
Since 321765@main, op_iterator_open puts a JSSentinel in iterator when it
iterates an Array. When the same loop has also seen a generic iterator, DFG
calls next with that operand as this. The call only runs when next is
callable, which it is not in FastArray mode, but the abstract value of iterator
still has the structure of the JSSentinel. If next is inlined and has a ToThis,
isToThisAnIdentity hits its assertion, since a JSSentinel is neither an object
nor a primitive that can be this.
This patch checks that iterator is an object before the generic call, next to
the existing check on next.
* JSTests/stress/for-of-fast-array-and-iterator-with-known-structure.js: Added.
(shouldBe):
(second):
(collect):
(breakAtTwo):
(firstTwo):
* Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp:
(JSC::DFG::ByteCodeParser::handleIteratorNext):
Canonical link: https://commits.webkit.org/322014@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
