Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: cd07e3f6c0c048727d29f1c470315bcbf81cad36
https://github.com/WebKit/WebKit/commit/cd07e3f6c0c048727d29f1c470315bcbf81cad36
Author: Yijia Huang <[email protected]>
Date: 2026-06-25 (Thu, 25 Jun 2026)
Changed paths:
M Source/WTF/wtf/JSONValues.cpp
Log Message:
-----------
JSON::Value::dump corrupts large string values via PrintStream truncation
https://bugs.webkit.org/show_bug.cgi?id=317785
rdar://180554350
Reviewed by Yusuke Suzuki.
JSON::Value::dump prints String values via out.print(builder.toString()),
which dispatches through PrintStream's printInternal(const CString&)
overload. That overload truncates large CStrings, replacing the tail
with "...[N characters not shown]" — a sane policy for terminal log
output, but it silently corrupts the JSON we just escaped: the closing
'"' of the string literal gets eaten, and the next "key": appears as if
inside the string, leaving an unparseable file.
Reachable in practice via the JSC bytecode profiler (jsc -p file.json):
JS source code in the "source" field of each Bytecodes record routinely
crosses the truncation threshold on JetStream3 subtests like
babylonjs-startup-es5 (30+ truncations in one profile, breaking
downstream parsers).
Bypass by routing through PrintStream's const char* overload, which is a
plain printf("%s", ...) with no length cap. CString from String::utf8()
is null-terminated, so this is safe.
A FIXME notes that PrintStream's truncation policy should not apply to
file persistence at all — a systematic fix in PrintStream would also
cover SamplingProfiler text dumps and any future site that prints large
Strings to disk. This patch only covers the JSON path, which is the
only one currently observed to break structured output.
Canonical link: https://commits.webkit.org/315824@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
