LibJS: Disable optimization in IteratorNextUnpack if next() is redefined

81b6a11 regressed correctness by always bypassing the `next()` method resolution for built-in iterators, causing incorrect behavior when `next()` was redefined on built-in prototypes. This change fixes the issue by storing a flag on built-in prototypes indicating whether `next()` has ever been redefined.
Author: https://github.com/kalenikaliaksandr Commit: f405d71657 Pull-request: https://github.com/LadybirdBrowser/ladybird/pull/4700
2025-08-13 03:29:49 +00:00 · 2025-05-12 04:27:25 +03:00 · 2025-05-12 04:27:25 +03:00 · f405d71657 · 2025-05-12 11:42:25 +00:00
commit f405d71657
parent a6d9e8acd8
18 changed files with 151 additions and 8 deletions
--- a/Libraries/LibJS/Runtime/MapIterator.h
+++ b/Libraries/LibJS/Runtime/MapIterator.h
@ -22,7 +22,12 @@ public:

    virtual ~MapIterator() override = default;

-    BuiltinIterator* as_builtin_iterator() override { return this; }
+    BuiltinIterator* as_builtin_iterator_if_next_is_not_redefined() override
+    {
+        if (m_next_method_was_redefined)
+            return nullptr;
+        return this;
+    }
    ThrowCompletionOr<void> next(VM&, bool& done, Value& value) override;

 private: