313230 2026-04-24 06:12:50 -0700 [JSC] `new DataView(buffer, byteOffset, byteLength)` should compliant the step 9-b of `25.3.2.1 DataView` abstract operation in the spec 2026-05-10 03:43:45 -0700 1 1 1 Unclassified WebKit JavaScriptCore WebKit Nightly Build Unspecified Unspecified RESOLVED FIXED InRadar P2 Normal --- 313416 1 tetsuharu.ohzeki tetsuharu.ohzeki webkit-bug-importer oldest_to_newest 2204120 0 479282 tetsuharu.ohzeki 2026-04-24 06:12:50 -0700 Created attachment 479282 testcase as jsc stress test According to the spec (April 24, 2026), the following code (the attached diff contains ) should works, but not at https://commits.webkit.org/309786@main. I attaches the jsc stress test format. ```js function assert(ok, message = '') { if (!ok) throw new Error(`Assertion!: ${message}`); } function sameValue(a, b, testname) { if (a !== b) throw new Error(`${testname}: Expected ${b} but got ${a}`); } function shouldThrow(caseName, fn, expectedErrorCtor, expectedErrorMessage) { if (!caseName) throw new Error(`must specify test case name`); const expected = `${expectedErrorCtor.name}(${expectedErrorMessage})`; try { fn(); throw new Error(`${caseName}: Expected to throw ${expected}, but succeeded`); } catch (e) { const actual = `${e.name}(${e.message})`; if (!(e instanceof expectedErrorCtor) || e.message !== expectedErrorMessage) throw new Error(`${caseName}: Expected ${expected} but got ${actual}`); } } const TEST_TARGET = [ DataView, ]; for (const targetCtor of TEST_TARGET) { const name = targetCtor.name; const buffer = new ArrayBuffer(4096); const byteOffset = 2048; const actualByteLength = 2048 + 1; // https://tc39.es/ecma262/#sec-dataview-buffer-byteoffset-bytelength assert((byteOffset + actualByteLength ) > buffer.byteLength, `25.3.2.1, step 9-b's condition not satisfied`); const byteLength = { valueOf: function () { $.detachArrayBuffer(buffer); $.gc(); return actualByteLength; } }; // By the spec (April 24, 2026), // https://tc39.es/ecma262/#sec-dataview-buffer-byteoffset-bytelength defines: // // 1. The step 3 get _offset_ by ToIndex(byteOffset). // - We fix that in bug 311903 if the byteOffset is weird and this steps detachs the buffer. // 2. Check IsDetachedBuffer(buffer), but ok. // 3. The step 9-a get _viewByteLength_ by ToIndex(byteLength). // - This detach the buffer. // 4. The step 9-b check whether `offset + viewByteLength > bufferByteLength` and throw RangeError. shouldThrow(`${name}: should throw as the expected`, () => { new targetCtor(buffer, byteOffset, byteLength); }, RangeError, 'TODO: this should be update the JSC actual error message'); sameValue(buffer.detached, true, `${label}: arrayBuffer is detached as expectedly`); // The detached ArrayBuffer.byteLength should be set to 0. // // - https://tc39.es/ecma262/#sec-detacharraybuffer // - https://tc39.es/ecma262/#sec-get-arraybuffer.prototype.bytelength sameValue(buffer.byteLength, 0, `${label}: arrayBuffer.byteLength is 0`); } ``` --- The similar pattern of this does not applied to other %TypedArray%. In https://tc39.es/ecma262/#sec-initializetypedarrayfromarraybuffer, which is invoked by the step 7-c of https://tc39.es/ecma262/#sec-typedarray: 1. The step 3 get _offset_ by ToIndex(byteOffset). - The weird `byteOffset ` detach the buffer here. 2. The step 7 check IsDetachedBuffer(buffer) and throw TypeError. 3. The step 9-b-2 checks whether `offset + newByteLength > bufferByteLength` and throw RangeError if it's true. 2204123 1 tetsuharu.ohzeki 2026-04-24 06:24:50 -0700 - Firefox 152.0a1 https://hg-edge.mozilla.org/mozilla-central/rev/2a5398c41a2cbc8221cfebda2e46759afd1fa482 - Google Chrome 149.0.7810.2 works fine with the attached testcase (we can test it by replacing `$.detachArrayBuffer(buffer)` to `buffer.transfer()`). 2204202 2 tetsuharu.ohzeki 2026-04-24 10:54:12 -0700 Pull request: https://github.com/WebKit/WebKit/pull/63535 2206553 3 webkit-bug-importer 2026-05-01 06:13:10 -0700 <rdar://problem/176016346> 2209470 4 ews-feeder 2026-05-10 03:43:43 -0700 Committed 312964@main (bc5968157109): <https://commits.webkit.org/312964@main> Reviewed commits have been landed. Closing PR #63535 and removing active labels. 479282 2026-04-24 06:12:50 -0700 2026-04-24 06:12:50 -0700 testcase as jsc stress test test.patch text/plain 6215 tetsuharu.ohzeki ZGlmZiAtLWdpdCBhL0pTVGVzdHMvc3RyZXNzL2RhdGF2aWV3LWNvbnN0cnVjdG9yLWJ1Zy14eHh4 LXdlaXJkLWJ5dGVsZW5ndGgtZGV0YWNoLWJ1ZmZlci1hbmQtb3ZlcnJ1bi5qcyBiL0pTVGVzdHMv c3RyZXNzL2RhdGF2aWV3LWNvbnN0cnVjdG9yLWJ1Zy14eHh4LXdlaXJkLWJ5dGVsZW5ndGgtZGV0 YWNoLWJ1ZmZlci1hbmQtb3ZlcnJ1bi5qcwpuZXcgZmlsZSBtb2RlIDEwMDY0NAppbmRleCAwMDAw MDAwMDAwMDAuLjc0MjFjMzcxODI0ZAotLS0gL2Rldi9udWxsCisrKyBiL0pTVGVzdHMvc3RyZXNz L2RhdGF2aWV3LWNvbnN0cnVjdG9yLWJ1Zy14eHh4LXdlaXJkLWJ5dGVsZW5ndGgtZGV0YWNoLWJ1 ZmZlci1hbmQtb3ZlcnJ1bi5qcwpAQCAtMCwwICsxLDY2IEBACitmdW5jdGlvbiBhc3NlcnQob2ss IG1lc3NhZ2UgPSAnJykgeworICAgIGlmICghb2spCisgICAgICAgIHRocm93IG5ldyBFcnJvcihg QXNzZXJ0aW9uITogJHttZXNzYWdlfWApOyAKK30KKworZnVuY3Rpb24gc2FtZVZhbHVlKGEsIGIs IHRlc3RuYW1lKSB7CisgICAgaWYgKGEgIT09IGIpCisgICAgICAgIHRocm93IG5ldyBFcnJvcihg JHt0ZXN0bmFtZX06IEV4cGVjdGVkICR7Yn0gYnV0IGdvdCAke2F9YCk7Cit9CisKK2Z1bmN0aW9u IHNob3VsZFRocm93KGNhc2VOYW1lLCBmbiwgZXhwZWN0ZWRFcnJvckN0b3IsIGV4cGVjdGVkRXJy b3JNZXNzYWdlKSB7CisgICAgaWYgKCFjYXNlTmFtZSkKKyAgICAgICAgdGhyb3cgbmV3IEVycm9y KGBtdXN0IHNwZWNpZnkgdGVzdCBjYXNlIG5hbWVgKTsKKworICAgIGNvbnN0IGV4cGVjdGVkID0g YCR7ZXhwZWN0ZWRFcnJvckN0b3IubmFtZX0oJHtleHBlY3RlZEVycm9yTWVzc2FnZX0pYDsKKyAg ICB0cnkgeworICAgICAgICBmbigpOworICAgICAgICB0aHJvdyBuZXcgRXJyb3IoYCR7Y2FzZU5h bWV9OiBFeHBlY3RlZCB0byB0aHJvdyAke2V4cGVjdGVkfSwgYnV0IHN1Y2NlZWRlZGApOworICAg IH0gY2F0Y2ggKGUpIHsKKyAgICAgICAgY29uc3QgYWN0dWFsID0gYCR7ZS5uYW1lfSgke2UubWVz c2FnZX0pYDsKKyAgICAgICAgaWYgKCEoZSBpbnN0YW5jZW9mIGV4cGVjdGVkRXJyb3JDdG9yKSB8 fCBlLm1lc3NhZ2UgIT09IGV4cGVjdGVkRXJyb3JNZXNzYWdlKQorICAgICAgICAgICAgdGhyb3cg bmV3IEVycm9yKGAke2Nhc2VOYW1lfTogRXhwZWN0ZWQgJHtleHBlY3RlZH0gYnV0IGdvdCAke2Fj dHVhbH1gKTsKKyAgICB9Cit9CisKK2NvbnN0IFRFU1RfVEFSR0VUID0gWworICAgIERhdGFWaWV3 LAorXTsKKworZm9yIChjb25zdCB0YXJnZXRDdG9yIG9mIFRFU1RfVEFSR0VUKSB7CisgICAgY29u c3QgbmFtZSA9IHRhcmdldEN0b3IubmFtZTsKKworICAgIGNvbnN0IGJ1ZmZlciA9IG5ldyBBcnJh eUJ1ZmZlcig0MDk2KTsKKyAgICBjb25zdCBieXRlT2Zmc2V0ID0gMjA0ODsKKyAgICBjb25zdCBh Y3R1YWxCeXRlTGVuZ3RoID0gMjA0OCArIDE7CisgICAgLy8gaHR0cHM6Ly90YzM5LmVzL2VjbWEy NjIvI3NlYy1kYXRhdmlldy1idWZmZXItYnl0ZW9mZnNldC1ieXRlbGVuZ3RoCisgICAgYXNzZXJ0 KChieXRlT2Zmc2V0ICsgYWN0dWFsQnl0ZUxlbmd0aCApID4gYnVmZmVyLmJ5dGVMZW5ndGgsIGAy NS4zLjIuMSwgc3RlcCA5LWIncyBjb25kaXRpb24gbm90IHNhdGlzZmllZGApOworCisgICAgY29u c3QgYnl0ZUxlbmd0aCA9IHsKKyAgICAgICAgdmFsdWVPZjogZnVuY3Rpb24gKCkgeworICAgICAg ICAgICAgJC5kZXRhY2hBcnJheUJ1ZmZlcihidWZmZXIpOworICAgICAgICAgICAgJC5nYygpOwor ICAgICAgICAgICAgcmV0dXJuIGFjdHVhbEJ5dGVMZW5ndGg7CisgICAgICAgIH0KKyAgICB9Owor CisgICAgLy8gQnkgdGhlIHNwZWMgKEFwcmlsIDI0LCAyMDI2KSwKKyAgICAvLyBodHRwczovL3Rj MzkuZXMvZWNtYTI2Mi8jc2VjLWRhdGF2aWV3LWJ1ZmZlci1ieXRlb2Zmc2V0LWJ5dGVsZW5ndGgg ZGVmaW5lczoKKyAgICAvLworICAgIC8vICAxLiBUaGUgc3RlcCAzIGdldCBfb2Zmc2V0XyBieSBU b0luZGV4KGJ5dGVPZmZzZXQpLgorICAgIC8vICAgICAgLSBXZSBmaXggdGhhdCBpbiBidWcgMzEx OTAzIGlmIHRoZSBieXRlT2Zmc2V0IGlzIHdlaXJkIGFuZCB0aGlzIHN0ZXBzIGRldGFjaHMgdGhl IGJ1ZmZlci4KKyAgICAvLyAgMi4gQ2hlY2sgSXNEZXRhY2hlZEJ1ZmZlcihidWZmZXIpLCBidXQg b2suCisgICAgLy8gIDMuIFRoZSBzdGVwIDktYSBnZXQgX3ZpZXdCeXRlTGVuZ3RoXyBieSBUb0lu ZGV4KGJ5dGVMZW5ndGgpLgorICAgIC8vICAgICAgLSBUaGlzIGRldGFjaCB0aGUgYnVmZmVyLgor ICAgIC8vICA0LiBUaGUgc3RlcCA5LWIgY2hlY2sgd2hldGhlciBgb2Zmc2V0ICsgdmlld0J5dGVM ZW5ndGggPiBidWZmZXJCeXRlTGVuZ3RoYCBhbmQgdGhyb3cgUmFuZ2VFcnJvci4KKyAgICBzaG91 bGRUaHJvdyhgJHtuYW1lfTogc2hvdWxkIHRocm93IGFzIHRoZSBleHBlY3RlZGAsICgpID0+IHsK KyAgICAgICAgbmV3IHRhcmdldEN0b3IoYnVmZmVyLCBieXRlT2Zmc2V0LCBieXRlTGVuZ3RoKTsK KyAgICB9LCBSYW5nZUVycm9yLCAnVE9ETzogdGhpcyBzaG91bGQgYmUgdXBkYXRlIHRoZSBKU0Mg YWN0dWFsIGVycm9yIG1lc3NhZ2UnKTsKKyAgICBzYW1lVmFsdWUoYnVmZmVyLmRldGFjaGVkLCB0 cnVlLCBgJHtsYWJlbH06IGFycmF5QnVmZmVyIGlzIGRldGFjaGVkIGFzIGV4cGVjdGVkbHlgKTsK KworICAgIC8vIFRoZSBkZXRhY2hlZCBBcnJheUJ1ZmZlci5ieXRlTGVuZ3RoIHNob3VsZCBiZSBz ZXQgdG8gMC4KKyAgICAvLworICAgIC8vICAtIGh0dHBzOi8vdGMzOS5lcy9lY21hMjYyLyNzZWMt ZGV0YWNoYXJyYXlidWZmZXIKKyAgICAvLyAgLSBodHRwczovL3RjMzkuZXMvZWNtYTI2Mi8jc2Vj LWdldC1hcnJheWJ1ZmZlci5wcm90b3R5cGUuYnl0ZWxlbmd0aAorICAgIHNhbWVWYWx1ZShidWZm ZXIuYnl0ZUxlbmd0aCwgMCwgYCR7bGFiZWx9OiBhcnJheUJ1ZmZlci5ieXRlTGVuZ3RoIGlzIDBg KTsKK30KXCBObyBuZXdsaW5lIGF0IGVuZCBvZiBmaWxlCmRpZmYgLS1naXQgYS9KU1Rlc3RzL3N0 cmVzcy90eXBlZGFycmF5LWNvbnN0cnVjdG9yLWJ1Zy14eHh4LXdlaXJkLWJ5dGVsZW5ndGgtZGV0 YWNoLWJ1ZmZlci1hbmQtb3ZlcnJ1bi5qcyBiL0pTVGVzdHMvc3RyZXNzL3R5cGVkYXJyYXktY29u c3RydWN0b3ItYnVnLXh4eHgtd2VpcmQtYnl0ZWxlbmd0aC1kZXRhY2gtYnVmZmVyLWFuZC1vdmVy cnVuLmpzCm5ldyBmaWxlIG1vZGUgMTAwNjQ0CmluZGV4IDAwMDAwMDAwMDAwMC4uODAwMjQyYmY1 YmY2Ci0tLSAvZGV2L251bGwKKysrIGIvSlNUZXN0cy9zdHJlc3MvdHlwZWRhcnJheS1jb25zdHJ1 Y3Rvci1idWcteHh4eC13ZWlyZC1ieXRlbGVuZ3RoLWRldGFjaC1idWZmZXItYW5kLW92ZXJydW4u anMKQEAgLTAsMCArMSw3NyBAQAorZnVuY3Rpb24gYXNzZXJ0KG9rLCBtZXNzYWdlID0gJycpIHsK KyAgICBpZiAoIW9rKQorICAgICAgICB0aHJvdyBuZXcgRXJyb3IoYEFzc2VydGlvbiE6ICR7bWVz c2FnZX1gKTsgCit9CisKK2Z1bmN0aW9uIHNhbWVWYWx1ZShhLCBiLCB0ZXN0bmFtZSkgeworICAg IGlmIChhICE9PSBiKQorICAgICAgICB0aHJvdyBuZXcgRXJyb3IoYCR7dGVzdG5hbWV9OiBFeHBl Y3RlZCAke2J9IGJ1dCBnb3QgJHthfWApOworfQorCitmdW5jdGlvbiBzaG91bGRUaHJvdyhjYXNl TmFtZSwgZm4sIGV4cGVjdGVkRXJyb3JDdG9yLCBleHBlY3RlZEVycm9yTWVzc2FnZSkgeworICAg IGlmICghY2FzZU5hbWUpCisgICAgICAgIHRocm93IG5ldyBFcnJvcihgbXVzdCBzcGVjaWZ5IHRl c3QgY2FzZSBuYW1lYCk7CisKKyAgICBjb25zdCBleHBlY3RlZCA9IGAke2V4cGVjdGVkRXJyb3JD dG9yLm5hbWV9KCR7ZXhwZWN0ZWRFcnJvck1lc3NhZ2V9KWA7CisgICAgdHJ5IHsKKyAgICAgICAg Zm4oKTsKKyAgICAgICAgdGhyb3cgbmV3IEVycm9yKGAke2Nhc2VOYW1lfTogRXhwZWN0ZWQgdG8g dGhyb3cgJHtleHBlY3RlZH0sIGJ1dCBzdWNjZWVkZWRgKTsKKyAgICB9IGNhdGNoIChlKSB7Cisg ICAgICAgIGNvbnN0IGFjdHVhbCA9IGAke2UubmFtZX0oJHtlLm1lc3NhZ2V9KWA7CisgICAgICAg IGlmICghKGUgaW5zdGFuY2VvZiBleHBlY3RlZEVycm9yQ3RvcikgfHwgZS5tZXNzYWdlICE9PSBl eHBlY3RlZEVycm9yTWVzc2FnZSkKKyAgICAgICAgICAgIHRocm93IG5ldyBFcnJvcihgJHtjYXNl TmFtZX06IEV4cGVjdGVkICR7ZXhwZWN0ZWR9IGJ1dCBnb3QgJHthY3R1YWx9YCk7CisgICAgfQor fQorCitjb25zdCBURVNUX1RBUkdFVCA9IFsKKyAgICBCaWdJbnQ2NEFycmF5LAorICAgIEJpZ1Vp bnQ2NEFycmF5LAorICAgIEZsb2F0MTZBcnJheSwKKyAgICBGbG9hdDMyQXJyYXksCisgICAgRmxv YXQ2NEFycmF5LAorICAgIEludDE2QXJyYXksCisgICAgSW50MzJBcnJheSwKKyAgICBJbnQ4QXJy YXksCisgICAgVWludDE2QXJyYXksCisgICAgVWludDMyQXJyYXksCisgICAgVWludDhBcnJheSwK KyAgICBVaW50OENsYW1wZWRBcnJheSwKK107CisKK2ZvciAoY29uc3QgdGFyZ2V0Q3RvciBvZiBU RVNUX1RBUkdFVCkgeworICAgIGNvbnN0IG5hbWUgPSB0YXJnZXRDdG9yLm5hbWU7CisKKyAgICBj b25zdCBidWZmZXIgPSBuZXcgQXJyYXlCdWZmZXIoNDA5Nik7CisgICAgY29uc3QgYnl0ZU9mZnNl dCA9IDIwNDg7CisgICAgY29uc3QgYWN0dWFsQnl0ZUxlbmd0aCA9IDIwNDggKyAxOworICAgIC8v IGh0dHBzOi8vdGMzOS5lcy9lY21hMjYyLyNzZWMtaW5pdGlhbGl6ZXR5cGVkYXJyYXlmcm9tYXJy YXlidWZmZXIKKyAgICBhc3NlcnQoKGJ5dGVPZmZzZXQgKyBhY3R1YWxCeXRlTGVuZ3RoICkgPiBi dWZmZXIuYnl0ZUxlbmd0aCwgYDIzLjIuNS4xLjMsIHN0ZXAgOS1iLTIncyBjb25kaXRpb24gbm90 IHNhdGlzZmllZGApOworCisgICAgY29uc3QgYnl0ZUxlbmd0aCA9IHsKKyAgICAgICAgdmFsdWVP ZjogZnVuY3Rpb24gKCkgeworICAgICAgICAgICAgJC5kZXRhY2hBcnJheUJ1ZmZlcihidWZmZXIp OworICAgICAgICAgICAgJC5nYygpOworICAgICAgICAgICAgcmV0dXJuIGFjdHVhbEJ5dGVMZW5n dGg7CisgICAgICAgIH0KKyAgICB9OworCisgICAgLy8gQnkgdGhlIHNwZWMgKEFwcmlsIDI0LCAy MDI2KSwKKyAgICAvLyBodHRwczovL3RjMzkuZXMvZWNtYTI2Mi8jc2VjLWluaXRpYWxpemV0eXBl ZGFycmF5ZnJvbWFycmF5YnVmZmVyLAorICAgIC8vIHdoaWNoIGlzIGludm9rZWQgYnkgdGhlIHN0 ZXAgNy1jIG9mIGh0dHBzOi8vdGMzOS5lcy9lY21hMjYyLyNzZWMtdHlwZWRhcnJheSwgZGVmaW5l czoKKyAgICAvLworICAgIC8vICAxLiBUaGUgc3RlcCAzIGdldCBfb2Zmc2V0XyBieSBUb0luZGV4 KGJ5dGVPZmZzZXQpLgorICAgIC8vICAgICAgLSBUaGUgd2VpcmQgYGJ5dGVPZmZzZXQgYCBkZXRh Y2ggdGhlIGJ1ZmZlciBoZXJlLgorICAgIC8vICAyLiBUaGUgc3RlcCA3IGNoZWNrIElzRGV0YWNo ZWRCdWZmZXIoYnVmZmVyKSBhbmQgdGhyb3cgVHlwZUVycm9yLgorICAgIC8vICAzLiBUaGUgc3Rl cCA5LWItMiBjaGVja3Mgd2hldGhlciBgb2Zmc2V0ICsgbmV3Qnl0ZUxlbmd0aCA+IGJ1ZmZlckJ5 dGVMZW5ndGhgLAorICAgIC8vICAgICBidXQgbm90IHJlYWNoZWQgdG8gaGVyZSBieSB0aGUgc3Rl cCA3IGluIGNvbnRyYXN0IHRvIERhdGFWaWV3KCkncyBzaW1pbGFyIHBhdHRlcm4uCisgICAgc2hv dWxkVGhyb3coYCR7bmFtZX06IHNob3VsZCB0aHJvdyBhcyB0aGUgZXhwZWN0ZWRgLCAoKSA9PiB7 CisgICAgICAgIG5ldyB0YXJnZXRDdG9yKGJ1ZmZlciwgYnl0ZU9mZnNldCwgYnl0ZUxlbmd0aCk7 CisgICAgfSwgVHlwZUVycm9yLCAnQnVmZmVyIGlzIGFscmVhZHkgZGV0YWNoZWQnKTsKKyAgICBz YW1lVmFsdWUoYnVmZmVyLmRldGFjaGVkLCB0cnVlLCBgJHtuYW1lfTogYXJyYXlCdWZmZXIgaXMg ZGV0YWNoZWQgYXMgZXhwZWN0ZWRseWApOworCisgICAgLy8gVGhlIGRldGFjaGVkIEFycmF5QnVm ZmVyLmJ5dGVMZW5ndGggc2hvdWxkIGJlIHNldCB0byAwLgorICAgIC8vCisgICAgLy8gIC0gaHR0 cHM6Ly90YzM5LmVzL2VjbWEyNjIvI3NlYy1kZXRhY2hhcnJheWJ1ZmZlcgorICAgIC8vICAtIGh0 dHBzOi8vdGMzOS5lcy9lY21hMjYyLyNzZWMtZ2V0LWFycmF5YnVmZmVyLnByb3RvdHlwZS5ieXRl bGVuZ3RoCisgICAgc2FtZVZhbHVlKGJ1ZmZlci5ieXRlTGVuZ3RoLCAwLCBgJHtuYW1lfTogYXJy YXlCdWZmZXIuYnl0ZUxlbmd0aCBpcyAwYCk7Cit9ClwgTm8gbmV3bGluZSBhdCBlbmQgb2YgZmls ZQo=