Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 5cdd591edd58b5de7dd33492f523e66768413cb0
https://github.com/WebKit/WebKit/commit/5cdd591edd58b5de7dd33492f523e66768413cb0
Author: Shu-yu Guo <[email protected]>
Date: 2025-12-08 (Mon, 08 Dec 2025)
Changed paths:
A JSTests/stress/map-set-stale-iterator.js
M Source/JavaScriptCore/runtime/OrderedHashTableHelper.h
Log Message:
-----------
[JSC] Check bounds in OrderedHashTable's transitAndNext
https://bugs.webkit.org/show_bug.cgi?id=303784
rdar://165670104
Reviewed by Yusuke Suzuki.
Fixes a bug from the Map/Set iterator optimization from 302900@main an iterator
still needs to do bounds checking for the underlying storage's capacity to
account for the container shrinking during the iterator's lifetime.
Test: JSTests/stress/map-set-stale-iterator.js
Canonical link: https://commits.webkit.org/304131@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
