Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 1f47117433c89ce1346dac911b65494de2fb0295
https://github.com/WebKit/WebKit/commit/1f47117433c89ce1346dac911b65494de2fb0295
Author: Sosuke Suzuki <[email protected]>
Date: 2026-09-24 (Thu, 24 Sep 2026)
Changed paths:
A JSTests/stress/promise-resolve-reject-cross-realm-dfg.js
A JSTests/stress/promise-then-cross-realm-dfg.js
A JSTests/stress/promise-then-cross-realm-species.js
M Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp
M Source/JavaScriptCore/runtime/JSPromise.cpp
M Source/JavaScriptCore/runtime/JSPromisePrototype.cpp
Log Message:
-----------
[JSC] Promise fast paths should not be taken across realms
https://bugs.webkit.org/show_bug.cgi?id=325110
Reviewed by Yusuke Suzuki.
Fix two issues in the same way as 321451@main.
1. Promise.prototype.then / catch / finally took the fast path for a promise
from another realm, and created the derived promise in the current realm.
2. DFG inlined Promise.prototype.then, Promise.resolve and Promise.reject from
another realm, and ran them with the caller's realm.
Tests: JSTests/stress/promise-resolve-reject-cross-realm-dfg.js
JSTests/stress/promise-then-cross-realm-dfg.js
JSTests/stress/promise-then-cross-realm-species.js
* JSTests/stress/promise-resolve-reject-cross-realm-dfg.js: Added.
(shouldBe):
(realmOf):
(nothing):
(const.notConstructor):
(Capture):
(callResolve):
(callReject):
(realmOfError):
* JSTests/stress/promise-then-cross-realm-dfg.js: Added.
(shouldBe):
(realmOf):
(identity):
(callThen):
(callThenWithoutConstructor):
(callBorrowedThen):
* JSTests/stress/promise-then-cross-realm-species.js: Added.
(shouldBe):
(realmOf):
(withoutConstructor):
(withOwnProperty):
(identity):
(nothing):
(setUnhandledRejectionCallback):
(other.setUnhandledRejectionCallback):
* Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp:
(JSC::DFG::ByteCodeParser::handleIntrinsicCall):
* Source/JavaScriptCore/runtime/JSPromise.cpp:
(JSC::promiseSpeciesConstructor):
(JSC::JSPromise::then):
* Source/JavaScriptCore/runtime/JSPromisePrototype.cpp:
(JSC::JSC_DEFINE_HOST_FUNCTION):
Canonical link: https://commits.webkit.org/321864@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
