Created attachment 282289 [details] Sample file causing issue There is a bug in TypedArray.copyWithin that can be used to write to an absolute pointer. In JavaScriptCore/runtime/JSGenericTypedArrayViewPrototypeFunctions.h, the function genericTypedArrayViewProtoFuncCopyWithin contains the following code: long length = thisObject->length(); long to = argumentClampedIndexFromStartOrEnd(exec, 0, length); long from = argumentClampedIndexFromStartOrEnd(exec, 1, length); long final = argumentClampedIndexFromStartOrEnd(exec, 2, length, length); if (final < from) return JSValue::encode(exec->thisValue()); long count = std::min(length - std::max(to, from), final - from); typename ViewClass::ElementType* array = thisObject->typedVector(); memmove(array + to, array + from, count * thisObject->elementSize); argumentClampedIndexFromStartOrEnd will call valueOf on a parameter to the copyWithin function, which can contain a function that neuters the this array, causing the variable "array" to be null. However, the "to" and "from" variables can be very large values, up to 0x7fffffff, which could be valid pointers on ARM and 32-bit platforms. This allows an absolute pointer in this range to be written to. An HTML file demonstrating this issue is attached. This issue affects Safari Technology Preview and WebKit, but has not made it into production Safari yet (TypedArray.copyWithin is not supported). This bug is subject to a 90 day disclosure deadline. If 90 days elapse without a broadly available patch, then the bug report will automatically become visible to the public. -- [Our ref: https://bugs.chromium.org/p/project-zero/issues/detail?id=862] Credit is to Natalie Silvanovich of Google Project Zero
<rdar://problem/27069149>
Created attachment 282920 [details] Patch
Committed r202982: <http://trac.webkit.org/changeset/202982>
*** Bug 159239 has been marked as a duplicate of this bug. ***