Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 8f27e23da3f50ea65b0eac233f4a84069cf17459
https://github.com/WebKit/WebKit/commit/8f27e23da3f50ea65b0eac233f4a84069cf17459
Author: Sosuke Suzuki <[email protected]>
Date: 2026-07-05 (Sun, 05 Jul 2026)
Changed paths:
A JSTests/stress/typedarray-from-oob-not-detached.js
M Source/JavaScriptCore/builtins/BuiltinNames.h
M Source/JavaScriptCore/builtins/TypedArrayConstructor.js
M Source/JavaScriptCore/bytecode/LinkTimeConstant.h
M Source/JavaScriptCore/runtime/JSGlobalObject.cpp
M Source/JavaScriptCore/runtime/JSTypedArrayViewPrototype.cpp
M Source/JavaScriptCore/runtime/JSTypedArrayViewPrototype.h
Log Message:
-----------
[JSC] `TypedArray.from()` spuriously throws when `mapFn` detaches or shrinks
https://bugs.webkit.org/show_bug.cgi?id=318596
Reviewed by Yusuke Suzuki.
The guards added in 316137@main stop writing when mapFn detaches or shrinks
the source/result typed array, but they consult @typedArrayLength before
(or instead of) checking out-of-bounds-ness, and @typedArrayLength throws a
TypeError for detached or out-of-bounds views. As a result,
const rab = new ArrayBuffer(32, { maxByteLength: 64 });
const source = new Int32Array(rab, 0, 8);
source[Symbol.iterator] = null;
Int32Array.from(source, (v, k) => { if (k === 4) rab.resize(16); return v;
});
throws a TypeError where the spec requires Get/Set on the now out-of-bounds
view to be silent. The same happens when mapFn detaches the result's buffer,
where the intended @isDetached(result) operand was unreachable dead code.
This change adds a non-throwing @isTypedArrayOutOfBounds private function
exposing JSArrayBufferView::isOutOfBounds() (the spec's
IsArrayBufferViewOutOfBounds, which also covers detached views) and makes
both guards check it before calling @typedArrayLength.
Test: JSTests/stress/typedarray-from-oob-not-detached.js
* JSTests/stress/typedarray-from-oob-not-detached.js: Added.
(shouldBe):
(testResultShrunkOutOfBounds.FixedLengthOnResizable):
(testResultShrunkOutOfBounds):
(testResultDetached.ViewOnTransferableBuffer):
(testResultDetached):
* Source/JavaScriptCore/builtins/BuiltinNames.h:
* Source/JavaScriptCore/builtins/TypedArrayConstructor.js:
(from):
* Source/JavaScriptCore/bytecode/LinkTimeConstant.h:
* Source/JavaScriptCore/runtime/JSGlobalObject.cpp:
(JSC::JSGlobalObject::init):
* Source/JavaScriptCore/runtime/JSTypedArrayViewPrototype.cpp:
(JSC::JSC_DEFINE_HOST_FUNCTION):
* Source/JavaScriptCore/runtime/JSTypedArrayViewPrototype.h:
Canonical link: https://commits.webkit.org/316525@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
