Bug 257737 – Speculative crash in WebCoreTypedArrayController::registerWrapper when JSGlobalObject* is not a JSDOMGlobalObject

• Status: RESOLVED
• Resolution: INVALID
• Component: JavaScriptCore

[Jarred Sumner]

The following line segfaults if it becomes possible for JSC::JSGlobalObject* to not be a JSDOMGlobalObject* in WebCore. For example, if ShadowRealm returns a non-JSDOMGlobalObject.

```
void WebCoreTypedArrayController::registerWrapper(JSC::JSGlobalObject* globalObject, JSC::ArrayBuffer* native, JSC::JSArrayBuffer* wrapper)
{
    cacheWrapper(JSC::jsCast<JSDOMGlobalObject*>(globalObject)->world(), native, wrapper);
}
```

This code was copied into Bun and in Bun's case, the Node.js "vm" module can be used to return an `ArrayBuffer` constructed in a different realm which is not a JSDOMGlobalObject*, so `require('vm').runInNewContext("new ArrayBuffer(42)")` segfaulted

https://github.com/oven-sh/bun/blob/17bca62df10008b2d252d5b63bd9b028e9fcd1c0/src/bun.js/bindings/webcore/WebCoreTypedArrayController.cpp#L54-L57

[Radar WebKit Bug Importer]

<rdar://problem/110679562>

[Yusuke Suzuki]

I don't think this is an issue. WebCore is adding a hook, so WebCore always creates JSDOMGlobalObject-derived shadow realm. So this condition is always met.
See `ShadowRealmGlobalScope` and `deriveShadowRealmGlobalObject`.