diff --git a/src/builtins/array-every.tq b/src/builtins/array-every.tq index b4dc4acd3b..a8a25eb8d8 100644 --- a/src/builtins/array-every.tq +++ b/src/builtins/array-every.tq @@ -92,6 +92,8 @@ namespace array { // Build a fast loop over the smi array. for (; k < len; k++) { + fastO.Recheck() otherwise goto Bailout(k); + // Ensure that we haven't walked beyond a possibly updated length. if (k >= fastO.Get().length) goto Bailout(k); @@ -105,7 +107,6 @@ namespace array { } } label FoundHole {} - fastO.Recheck() otherwise goto Bailout(k + 1); } return True; } diff --git a/src/builtins/array-filter.tq b/src/builtins/array-filter.tq index 12ea4c3312..50b43f6307 100644 --- a/src/builtins/array-filter.tq +++ b/src/builtins/array-filter.tq @@ -107,6 +107,8 @@ namespace array_filter { // Build a fast loop over the smi array. for (; k < len; k++) { + fastO.Recheck() otherwise goto Bailout(k, to); + // Ensure that we haven't walked beyond a possibly updated length. if (k >= fastO.Get().length) goto Bailout(k, to); const value: Object = LoadElementNoHole(fastO.Get(), k) @@ -128,7 +130,6 @@ namespace array_filter { } to = to + 1; } - fastO.Recheck() otherwise goto Bailout(k + 1, to); } } diff --git a/src/builtins/array-foreach.tq b/src/builtins/array-foreach.tq index 738c4b4e11..3dfb7d4d41 100644 --- a/src/builtins/array-foreach.tq +++ b/src/builtins/array-foreach.tq @@ -77,12 +77,13 @@ namespace array_foreach { // Build a fast loop over the smi array. for (; k < len; k++) { + fastO.Recheck() otherwise goto Bailout(k); + // Ensure that we haven't walked beyond a possibly updated length. if (k >= fastO.Get().length) goto Bailout(k); const value: Object = LoadElementNoHole(fastO.Get(), k) otherwise continue; Call(context, callbackfn, thisArg, value, k, fastO.Get()); - fastO.Recheck() otherwise goto Bailout(k + 1); } } diff --git a/src/builtins/array-map.tq b/src/builtins/array-map.tq index 562cc2b255..b165ee016e 100644 --- a/src/builtins/array-map.tq +++ b/src/builtins/array-map.tq @@ -191,6 +191,8 @@ namespace array_map { // Build a fast loop over the smi array. // 7. Repeat, while k < len. for (; k < len; k++) { + fastO.Recheck() otherwise goto Bailout(v, k); + // Ensure that we haven't walked beyond a possibly updated length. if (k >= fastO.Get().length) goto Bailout(v, k); @@ -200,7 +202,6 @@ namespace array_map { const result: Object = Call(context, callbackfn, thisArg, value, k, fastO.Get()); v.StoreResult(k, result); - fastO.Recheck() otherwise goto Bailout(v, k + 1); } label FoundHole { // Our output array must necessarily be holey because of holes in diff --git a/src/builtins/array-some.tq b/src/builtins/array-some.tq index 435bd2db4a..6aff9bc9c3 100644 --- a/src/builtins/array-some.tq +++ b/src/builtins/array-some.tq @@ -92,6 +92,8 @@ namespace array { // Build a fast loop over the smi array. for (; k < len; k++) { + fastO.Recheck() otherwise goto Bailout(k); + // Ensure that we haven't walked beyond a possibly updated length. if (k >= fastO.Get().length) goto Bailout(k); @@ -105,7 +107,6 @@ namespace array { } } label FoundHole {} - fastO.Recheck() otherwise goto Bailout(k + 1); } return False; }