Parents: #475, #493 Related: #473
Problem
Math.sumPrecise obtains the iterator object once, but calls callMethod(iter, "next", ...) for every step. That re-reads the observable next property each iteration instead of retaining the [[NextMethod]] captured by GetIterator. A getter or mutation can therefore change the method mid-consumption, diverging from ECMA-262 and potentially repeating attacker-controlled lookup side effects.
Scope
- Capture the iterator next method once before the first step.
- Invoke that exact value with the iterator as
thison every step. - Preserve IteratorClose precedence for a non-Number element and all existing exact-summation behavior.
- Cover a
nextgetter, mutation after the first step, non-callable captured methods, and abrupt completion.
No-workaround rules
- No array-only fast path, source rewriting, repeated property lookup, swallowed primary exception, skipped IteratorClose, or coercion of non-Number elements.
- No stack, queue, job, Promise, Worker, or Map/Set iterator implementation changes.
Acceptance
- The
nextgetter is observed exactly once and later mutation does not change the captured method. - Non-callable/throwing paths preserve the specified error and IteratorClose behavior.
- Focused units and the complete Test262
Math.sumPrecisesubtree pass with exact nonzero accounting. - Full integration gates pass with 0 unrelated Test262 flips.