Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 81661ec627ed367308f1eea1ba5d956d7a0f09b9
https://github.com/WebKit/WebKit/commit/81661ec627ed367308f1eea1ba5d956d7a0f09b9
Author: Chris Dumez <[email protected]>
Date: 2026-07-13 (Mon, 13 Jul 2026)
Changed paths:
M Source/WebCore/bindings/scripts/CodeGenerator.pm
Log Message:
-----------
[Bindings] ForAllParents crashes instead of pruning when a beforeRecursion
callback returns 'prune'
https://bugs.webkit.org/show_bug.cgi?id=319232
Reviewed by Darin Adler.
CodeGenerator::ForAllParents walks an interface's inheritance chain via a
recursive anonymous closure ($recurse). The closure supports pruning: if
the caller-supplied beforeRecursion callback returns the string 'prune',
recursion into that parent (and the matching afterRecursion call) is meant
to be skipped. However, it implemented the skip with `next`:
```
&$beforeRecursion($parentInterface) eq 'prune' and next;
```
`next` is loop control, but $recurse is a plain sub invoked outside of any
enclosing loop, so executing this path dies with "Can't \"next\" outside a
loop block" rather than pruning. Use `return` instead, which exits the
closure and thereby skips both the recursion into that parent and its
afterRecursion call, the intended prune semantics.
This is a latent bug: the prune feature is currently unreachable because no
in-tree caller passes a beforeRecursion callback that returns 'prune' (all
existing callers either omit the callback or return other values), so the
fatal path is never taken today. It would fire the moment any future
callback used the documented 'prune' sentinel, aborting code generation.
No bindings test is added because this path cannot be exercised through the
bindings test harness.
* Source/WebCore/bindings/scripts/CodeGenerator.pm:
(ForAllParents):
Canonical link: https://commits.webkit.org/317097@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
