dotCooCoo e85cecfa99 JavaScript: for-in over a String object checks the heap before listing its indices ...

Listing a String object's index names for for-in built one name per UTF-16 unit before any
limit check, so a string within the heap limit could make the loop allocate many times that
limit. The heap budget for all the names is now checked first, after a collection if needed,
and each name takes a unit of fuel. A wrapper made by ToObject stays rooted while the names
are listed.

2026-11-07 13:02:26 -08:00

..

src

JavaScript: for-in over a String object checks the heap before listing its indices

2026-11-07 13:02:26 -08:00

tests

JavaScript: interpreter with a garbage-collected heap and execution limits

2026-11-07 12:36:48 -08:00

Cargo.toml

JavaScript: interpreter with a garbage-collected heap and execution limits

2026-11-07 12:36:48 -08:00