Bug 285278

Summary: [JSC] Make `memcpy` for butterfly safer in `Array#toReversed` fast path
Product: WebKit Reporter: Sosuke Suzuki <aosukeke>
Component: JavaScriptCoreAssignee: Nobody <webkit-unassigned>
Status: RESOLVED FIXED    
Severity: Normal CC: katoshi1337, webkit-bug-importer
Priority: P2 Keywords: InRadar
Version: WebKit Local Build   
Hardware: Unspecified   
OS: Unspecified   

Sosuke Suzuki
Reported 2025-01-01 06:43:47 PST
We should initialize all vector fields of a butterfly before creating a new array with `createWithButterfly`. This is the same issue pointed out in https://github.com/WebKit/WebKit/pull/38429#discussion_r1900117330
Attachments
Add attachment proposed patch, testcase, etc.
Sosuke Suzuki
Comment 1 2025-01-01 06:46:37 PST
Pull request: https://github.com/WebKit/WebKit/pull/38451
EWS
Comment 2 2025-01-01 21:46:40 PST
Committed 288359@main (9158c52898ef): <https://commits.webkit.org/288359@main> Reviewed commits have been landed. Closing PR #38451 and removing active labels.
Radar WebKit Bug Importer
Comment 3 2025-01-01 21:47:16 PST
<rdar://problem/142252115>
Yusuke Suzuki
Comment 4 2025-01-07 16:53:45 PST
*** Bug 285080 has been marked as a duplicate of this bug. ***
Note You need to log in before you can comment on or make changes to this bug.