Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 54e08075c3f02b6442e12934f6d02a02265b808c
https://github.com/WebKit/WebKit/commit/54e08075c3f02b6442e12934f6d02a02265b808c
Author: Sosuke Suzuki <aosuk...@gmail.com>
Date: 2024-12-18 (Wed, 18 Dec 2024)
Changed paths:
A JSTests/stress/iterator-open-throw-for-non-objects.js
M Source/JavaScriptCore/jit/JITCall.cpp
Log Message:
-----------
[JSC] Iterator should throw a TypeError when it is String/BigInt/Symbol in
Baseline JIT
https://bugs.webkit.org/show_bug.cgi?id=256437
Reviewed by Yusuke Suzuki.
According to the spec[1], when opening an iterator, a TypeError should be
thrown if `Symbol.iterator`
returns a non-object value. However, the current Baseline JIT in JSC does not
throw a TypeError when
`Symbol.iterator` returns a BigInt, Symbol, or String.
This patch modifies `emit_op_iterator_open` to check if the iterator is an
object, and if not, it
falls back to the slow path.
[1]:
https://tc39.es/ecma262/multipage/abstract-operations.html#sec-getiteratorfrommethod
* JSTests/stress/iterator-open-throw-for-non-objects.js: Added.
(shouldBe):
(i.try.arr.Symbol.iterator):
(i.catch):
* Source/JavaScriptCore/jit/JITCall.cpp:
(JSC::JIT::emit_op_iterator_open):
Canonical link: https://commits.webkit.org/288071@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
_______________________________________________
webkit-changes mailing list
webkit-changes@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-changes
