RESOLVED FIXED285278
[JSC] Make `memcpy` for butterfly safer in `Array#toReversed` fast path 
https://bugs.webkit.org/show_bug.cgi?id=285278
Summary [JSC] Make `memcpy` for butterfly safer in `Array#toReversed` fast path
Sosuke Suzuki
Reported 2025-01-01 06:43:47 PST
We should initialize all vector fields of a butterfly before creating a new array with `createWithButterfly`. This is the same issue pointed out in https://github.com/WebKit/WebKit/pull/38429#discussion_r1900117330
Attachments
Add attachment proposed patch, testcase, etc.
Sosuke Suzuki
Comment 1 2025-01-01 06:46:37 PST
Pull request: https://github.com/WebKit/WebKit/pull/38451
EWS
Comment 2 2025-01-01 21:46:40 PST
Committed 288359@main (9158c52898ef): <https://commits.webkit.org/288359@main> Reviewed commits have been landed. Closing PR #38451 and removing active labels.
Radar WebKit Bug Importer
Comment 3 2025-01-01 21:47:16 PST
<rdar://problem/142252115>
Yusuke Suzuki
Comment 4 2025-01-07 16:53:45 PST
*** Bug 285080 has been marked as a duplicate of this bug. ***
Note You need to log in before you can comment on or make changes to this bug.