268075 2024-01-25 06:18:47 -0800 [JSC] TypedArray sorting methods should have a special-case for comparator returning `false` 2024-03-14 17:59:18 -0700 1 1 1 Unclassified WebKit JavaScriptCore WebKit Nightly Build All All RESOLVED FIXED https://bugs.webkit.org/show_bug.cgi?id=47825 InRadar P2 Major --- 1 M202271709 ashvayka ashvayka webkit-bug-importer oldest_to_newest 2007545 0 M202271709 2024-01-25 06:18:47 -0800 Execute the poc.js below. let arr = [10, 3, 8, 5, 30, 100, 6, 7, 100, 3] let obj = new Int8Array(arr); print(obj.toSorted((x, y) => { return x < y })) output: 10,3,8,5,30,100,6,7,100,3 expect: 100,100,30,10,8,7,6,5,3,3 Due to the fact that each element in the Int8Array is a number, the expected result of descending sorting would be '100, 100, 30, 10, 8, 7, 6, 5, 3, 3'. I have also tested this in other JavaScript engines, and the results align with expectations. I believe this could potentially pose a security issue. 2009719 1 webkit-bug-importer 2024-02-01 06:19:14 -0800 <rdar://problem/122093956> 2021125 2 ashvayka 2024-03-14 14:10:41 -0700 Pull request: https://github.com/WebKit/WebKit/pull/25902 2021199 3 ews-feeder 2024-03-14 17:59:16 -0700 Committed 276130@main (798d1789439a): <https://commits.webkit.org/276130@main> Reviewed commits have been landed. Closing PR #25902 and removing active labels.