Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 8fbefe5287a878076ed350832298646d80944e2f
https://github.com/WebKit/WebKit/commit/8fbefe5287a878076ed350832298646d80944e2f
Author: Sosuke Suzuki <[email protected]>
Date: 2025-11-24 (Mon, 24 Nov 2025)
Changed paths:
A JSTests/stress/null-butterfly-checking.js
M Source/JavaScriptCore/runtime/Structure.cpp
Log Message:
-----------
[JSC] Fix UBSan crash for null butterfly
https://bugs.webkit.org/show_bug.cgi?id=303015
Reviewed by Yusuke Suzuki.
This patch changes to add null checking for butterfly for fixing UBSan crash
like:
```
runtime/Structure.cpp:1042:41: runtime error: member call on null pointer of
type 'JSC::Butterfly'
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior
runtime/Structure.cpp:1042:41
/Users/sosukesuzuki/ghq/github.com/WebKit/WebKit/Source/JavaScriptCore/runtime/Butterfly.h:182:21:
runtime error: member call on null pointer of type 'JSC::Butterfly *'
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior
/Users/sosukesuzuki/ghq/github.com/WebKit/WebKit/Source/JavaScriptCore/runtime/Butterfly.h:182:21
/Users/sosukesuzuki/ghq/github.com/WebKit/WebKit/Source/JavaScriptCore/runtime/IndexingHeader.h:74:61:
runtime error: applying non-zero offset 18446744073709551608 to null pointer
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior
/Users/sosukesuzuki/ghq/github.com/WebKit/WebKit/Source/JavaScriptCore/runtime/IndexingHeader.h:74:61
runtime/Structure.cpp:1043:33: runtime error: member call on null pointer of
type 'JSC::Butterfly'
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior
runtime/Structure.cpp:1043:33
/Users/sosukesuzuki/ghq/github.com/WebKit/WebKit/Source/JavaScriptCore/runtime/Butterfly.h:222:11:
runtime error: member call on null pointer of type 'JSC::Butterfly *'
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior
/Users/sosukesuzuki/ghq/github.com/WebKit/WebKit/Source/JavaScriptCore/runtime/Butterfly.h:222:11
/Users/sosukesuzuki/ghq/github.com/WebKit/WebKit/Source/JavaScriptCore/runtime/Butterfly.h:184:21:
runtime error: member call on null pointer of type 'JSC::Butterfly *'
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior
/Users/sosukesuzuki/ghq/github.com/WebKit/WebKit/Source/JavaScriptCore/runtime/Butterfly.h:184:21
```
* JSTests/stress/null-butterfly-checking.js: Added.
(const.v3.p):
* Source/JavaScriptCore/runtime/Structure.cpp:
(JSC::Structure::flattenDictionaryStructure):
Canonical link: https://commits.webkit.org/303524@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
