Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 77c66694dfbc3ff72754d5e533ade4dd7c13ab99
https://github.com/WebKit/WebKit/commit/77c66694dfbc3ff72754d5e533ade4dd7c13ab99
Author: Anand Srinivasan <[email protected]>
Date: 2026-06-24 (Wed, 24 Jun 2026)
Changed paths:
A JSTests/stress/array-prototype-flat-reentrant-mutation.js
M Source/JavaScriptCore/runtime/JSArray.cpp
Log Message:
-----------
Check if JSArray::fastFlat exceeds maximum legal length
https://bugs.webkit.org/show_bug.cgi?id=317695
rdar://178997662
Reviewed by Sosuke Suzuki and Yusuke Suzuki.
JSC::JSArray::fastFlat crashes if the flattened array exceeds the
maximum length of the vector holding it. This patch changes it to return
null and bail out to the slow path in JSC::arrayProtoFuncFlat instead of
crashing.
Test: JSTests/stress/array-prototype-flat-reentrant-mutation.js
* JSTests/stress/array-prototype-flat-reentrant-mutation.js: Added.
(try.array.Symbol.iterator):
(catch):
* Source/JavaScriptCore/runtime/JSArray.cpp:
(JSC::JSArray::fastFlat):
Canonical link: https://commits.webkit.org/315760@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
