[webkit-changes] [WebKit/WebKit] 54e080: [JSC] Iterator should throw a TypeError when it is...

[SUZUKI Sosuke]

  Branch: refs/heads/main
  Home:   https://github.com/WebKit/WebKit
  Commit: 54e08075c3f02b6442e12934f6d02a02265b808c
      https://github.com/WebKit/WebKit/commit/54e08075c3f02b6442e12934f6d02a02265b808c
  Author: Sosuke Suzuki <aosukeke at gmail.com>
  Date:   2024-12-18 (Wed, 18 Dec 2024)

  Changed paths:
    A JSTests/stress/iterator-open-throw-for-non-objects.js
    M Source/JavaScriptCore/jit/JITCall.cpp

  Log Message:
  -----------
  [JSC] Iterator should throw a TypeError when it is String/BigInt/Symbol in Baseline JIT
https://bugs.webkit.org/show_bug.cgi?id=256437

Reviewed by Yusuke Suzuki.

According to the spec[1], when opening an iterator, a TypeError should be thrown if `Symbol.iterator`
returns a non-object value. However, the current Baseline JIT in JSC does not throw a TypeError when
`Symbol.iterator` returns a BigInt, Symbol, or String.

This patch modifies `emit_op_iterator_open` to check if the iterator is an object, and if not, it
falls back to the slow path.

[1]: https://tc39.es/ecma262/multipage/abstract-operations.html#sec-getiteratorfrommethod

* JSTests/stress/iterator-open-throw-for-non-objects.js: Added.
(shouldBe):
(i.try.arr.Symbol.iterator):
(i.catch):
* Source/JavaScriptCore/jit/JITCall.cpp:
(JSC::JIT::emit_op_iterator_open):

Canonical link: https://commits.webkit.org/288071@main



To unsubscribe from these emails, change your notification settings at https://github.com/WebKit/WebKit/settings/notifications