Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: fc179bd61c6cefb22988f84532515cff802cca0f
https://github.com/WebKit/WebKit/commit/fc179bd61c6cefb22988f84532515cff802cca0f
Author: Sosuke Suzuki <[email protected]>
Date: 2026-06-29 (Mon, 29 Jun 2026)
Changed paths:
A JSTests/stress/array-from-cloned-arguments-large-length.js
M Source/JavaScriptCore/runtime/ArrayConstructor.cpp
Log Message:
-----------
[JSC] `Array.from(arguments)` fast path should bail out when length exceeds
`MAX_STORAGE_VECTOR_LENGTH`
https://bugs.webkit.org/show_bug.cgi?id=318058
Reviewed by Yusuke Suzuki.
The Array.from(arguments) fast path allocates a contiguous butterfly sized from
the
arguments' length, but ClonedArguments' length is a writable own data property,
so a
user-controlled value above MAX_STORAGE_VECTOR_LENGTH reaches
IndexingHeader::setVectorLength and crashes on its RELEASE_ASSERT. Bail out to
the
generic Array.from path instead, as fastFlat already does.
'use strict';
function target() {
arguments.length = 0x10000001;
return Array.from(arguments);
}
target(1, 2, 3);
Test: JSTests/stress/array-from-cloned-arguments-large-length.js
* JSTests/stress/array-from-cloned-arguments-large-length.js: Added.
(target):
(catch):
* Source/JavaScriptCore/runtime/ArrayConstructor.cpp:
(JSC::tryCreateArrayFromArguments):
Canonical link: https://commits.webkit.org/316014@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
