Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 7a9d14998def6f77f60708cb89c5e68db69982e5
https://github.com/WebKit/WebKit/commit/7a9d14998def6f77f60708cb89c5e68db69982e5
Author: Kai Tamkun <[email protected]>
Date: 2026-06-30 (Tue, 30 Jun 2026)
Changed paths:
A JSTests/stress/typedarray-from-oob.js
M Source/JavaScriptCore/builtins/TypedArrayConstructor.js
Log Message:
-----------
[JSC] TypedArray.from() Out-of-Bounds Read via Resizable ArrayBuffer
resize/transfer in mapFn callback.
https://bugs.webkit.org/show_bug.cgi?id=312513
rdar://174428778
Reviewed by Yusuke Suzuki.
Adjusts TypedArray.from to properly handle cases where the map function changes
the bounds of the arraylike input.
Test: JSTests/stress/typedarray-from-oob.js
* JSTests/stress/typedarray-from-oob.js: Added.
(testResize):
(testDetach):
* Source/JavaScriptCore/builtins/TypedArrayConstructor.js:
(from):
Originally-landed-as: 305413.702@safari-7624-branch (e99a325bb9b8).
rdar://180429231
Canonical link: https://commits.webkit.org/316137@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
