Bug 257737
| Summary: | Speculative crash in WebCoreTypedArrayController::registerWrapper when JSGlobalObject* is not a JSDOMGlobalObject | ||
|---|---|---|---|
| Product: | WebKit | Reporter: | Jarred Sumner <jarred> |
| Component: | JavaScriptCore | Assignee: | Nobody <webkit-unassigned> |
| Status: | RESOLVED INVALID | ||
| Severity: | Normal | CC: | cdumez, joseph.j.griego, mark.lam, webkit-bug-importer, ysuzuki |
| Priority: | P2 | Keywords: | InRadar |
| Version: | WebKit Nightly Build | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
Jarred Sumner
The following line segfaults if it becomes possible for JSC::JSGlobalObject* to not be a JSDOMGlobalObject* in WebCore. For example, if ShadowRealm returns a non-JSDOMGlobalObject.
```
void WebCoreTypedArrayController::registerWrapper(JSC::JSGlobalObject* globalObject, JSC::ArrayBuffer* native, JSC::JSArrayBuffer* wrapper)
{
cacheWrapper(JSC::jsCast<JSDOMGlobalObject*>(globalObject)->world(), native, wrapper);
}
```
This code was copied into Bun and in Bun's case, the Node.js "vm" module can be used to return an `ArrayBuffer` constructed in a different realm which is not a JSDOMGlobalObject*, so `require('vm').runInNewContext("new ArrayBuffer(42)")` segfaulted
https://github.com/oven-sh/bun/blob/17bca62df10008b2d252d5b63bd9b028e9fcd1c0/src/bun.js/bindings/webcore/WebCoreTypedArrayController.cpp#L54-L57
| Attachments | ||
|---|---|---|
| Add attachment proposed patch, testcase, etc. |
Radar WebKit Bug Importer
<rdar://problem/110679562>
Yusuke Suzuki
I don't think this is an issue. WebCore is adding a hook, so WebCore always creates JSDOMGlobalObject-derived shadow realm. So this condition is always met.
See `ShadowRealmGlobalScope` and `deriveShadowRealmGlobalObject`.