267494 2024-01-13 03:34:06 -0800 [JSC] Throw RangeError if Set methods are called on an object with negative "size" property 2024-02-04 13:19:38 -0800 1 1 1 Unclassified WebKit JavaScriptCore WebKit Nightly Build All All RESOLVED FIXED https://bugs.webkit.org/show_bug.cgi?id=251510 InRadar P2 Normal --- 268026 1 zloirock ashvayka ashvayka keith_miller mark.lam webkit-bug-importer ysuzuki oldest_to_newest 2004887 0 zloirock 2024-01-13 03:34:06 -0800 new Set([1, 2, 3]).difference({ size: -1, has() { return false; }, keys() { return { next() { return { done: true }; } }; }, }); should be a RangeError, GetSetRecord step 7. 2004888 1 zloirock 2024-01-13 03:49:56 -0800 Similar V8 issue https://bugs.chromium.org/p/v8/issues/detail?id=14559 2006339 2 webkit-bug-importer 2024-01-20 03:35:13 -0800 <rdar://problem/121310940> 2009872 3 ashvayka 2024-02-01 14:08:57 -0800 Pull request: https://github.com/WebKit/WebKit/pull/23689 2010224 4 ews-feeder 2024-02-02 12:53:13 -0800 Committed 274009@main (eeda72823e71): <https://commits.webkit.org/274009@main> Reviewed commits have been landed. Closing PR #23689 and removing active labels.