I've posted a patch that does two things: It inlines the `ArrayObject` `addProperty` hook code in `CallAddPropertyHook` similar to what we already do in `CallAddPropertyHookDense`. This ensures `CallAddPropertyHook` is infallible for arrays because we no longer have the unnecessary recursion check there. The other remaining places where we still use `addProperty`hooks is for some XPConnect objects (see bug 1973249). The patch also changes `CodeGenerator::visitLoadSlotByIteratorIndexCommon` to crash safely if we read the hole `MagicValue`, in addition to the bounds check we already had there. There's more work to do in follow-up bugs but for now these two changes are relatively small and safe.
Bug 2038575 Comment 5 Edit History
Note: The actual edited comment in the bug view page will always show the original commenter’s name and original timestamp.
I've posted a patch that does two things: It inlines the `ArrayObject` `addProperty` hook code in `CallAddPropertyHook` similar to what we already do in `CallAddPropertyHookDense`. This ensures `CallAddPropertyHook` is infallible for arrays because we no longer have the unnecessary recursion check there. The other remaining places where we still use `addProperty`hooks are XPConnect objects (see bug 1973249). The patch also changes `CodeGenerator::visitLoadSlotByIteratorIndexCommon` to crash safely if we read the hole `MagicValue`, in addition to the bounds check we already had there. There's more work to do in follow-up bugs but for now these two changes are relatively small and safe.