[webkit-changes] [WebKit/WebKit] ea7b82: [JSC] Iterator Helpers methods should not iterate ...

[SUZUKI Sosuke]

  Branch: refs/heads/main
  Home:   https://github.com/WebKit/WebKit
  Commit: ea7b8287cc3f7f5b98cf261bcca1ea12829a18bf
      https://github.com/WebKit/WebKit/commit/ea7b8287cc3f7f5b98cf261bcca1ea12829a18bf
  Author: Sosuke Suzuki <aosukeke at gmail.com>
  Date:   2024-09-19 (Thu, 19 Sep 2024)

  Changed paths:
    R JSTests/microbenchmarks/iterator-prototype-toArray-for-array.js
    M JSTests/stress/iterator-prototype-forEach.js
    R JSTests/stress/iterator-prototype-toArray-empty.js
    M JSTests/stress/iterator-prototype-toArray.js
    M Source/JavaScriptCore/runtime/IteratorOperations.h
    M Source/JavaScriptCore/runtime/JSIteratorPrototype.cpp

  Log Message:
  -----------
  [JSC] Iterator Helpers methods should not iterate an array
https://bugs.webkit.org/show_bug.cgi?id=279876

Reviewed by Alexey Shvayka.

We implemented a function called `forEachInIteratorProtocol` to implement
`Iterator.prototype.toArray`[1]. As the name suggests, this function iterates over objects that
conform to the iterator protocol, but it also iterates over fast arrays.

The methods of Iterator Helpers use the `GetIteratorDirect` abstract operation[2] to directly get
the object's `next` property. Unlike the `GetIterator` abstract operation[3], it does not get the
`@@iterator`.

This patch changes the `forEachInIteratorProtocol` function to stop iterating over arrays. It also
removes the fast path for fast arrays in `Iterator.prototype.toArray`[4].

[1]: https://commits.webkit.org/283381@main
[2]: https://tc39.es/proposal-iterator-helpers/#sec-getiteratordirect
[3]: https://tc39.es/ecma262/#sec-getiterator
[4]: https://commits.webkit.org/283381@main

* JSTests/microbenchmarks/iterator-prototype-toArray-for-array.js: Removed.
* JSTests/stress/iterator-prototype-forEach.js:
(sameArray):
(const.validIter): Deleted.
(const.invalidCallback.of.invalidCallbacks.shouldThrow): Deleted.
* JSTests/stress/iterator-prototype-toArray-empty.js: Removed.
* JSTests/stress/iterator-prototype-toArray.js:
(sameArray):
* Source/JavaScriptCore/runtime/IteratorOperations.h:
(JSC::forEachInIteratorProtocol):
* Source/JavaScriptCore/runtime/JSIteratorPrototype.cpp:
(JSC::JSC_DEFINE_HOST_FUNCTION):

Canonical link: https://commits.webkit.org/283933@main



To unsubscribe from these emails, change your notification settings at https://github.com/WebKit/WebKit/settings/notifications