Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 7ff7d1247aaa78cc8b729f3b65f5f6b7321ad919
https://github.com/WebKit/WebKit/commit/7ff7d1247aaa78cc8b729f3b65f5f6b7321ad919
Author: Sosuke Suzuki <[email protected]>
Date: 2026-07-13 (Mon, 13 Jul 2026)
Changed paths:
M Source/JavaScriptCore/tools/Integrity.h
Log Message:
-----------
[JSC] `Integrity::isSanePointer()` should check alignment for typed pointers
https://bugs.webkit.org/show_bug.cgi?id=319215
Reviewed by Yusuke Suzuki.
A sane pointer to a T must be aligned like a T. Add a typed overload that
checks this on top of the existing canonical-address check. The void*
overload keeps its old behavior for callers probing arbitrary addresses
(e.g. the disassembler); all typed call sites pick up the stricter check
without change.
This catches the value seen in a real crash: a concurrent DFG thread read
HeapCell::zap() residue (0x21700000002) out of a freshly reused JSString and
dereferenced it as a StringImpl*, because it passed every existing check in
speculationFromCell() (https://github.com/oven-sh/WebKit/pull/285). The
reordering race itself is fixed in bug 319213; this hardens the checks that
bug 216638 added as a mitigation for bad pointers from profiling data.
* Source/JavaScriptCore/tools/Integrity.h:
(JSC::Integrity::isSanePointer):
Canonical link: https://commits.webkit.org/317118@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
