Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: c8525868de350de8b7b60cfc0a5a4c730ffe2d19
https://github.com/WebKit/WebKit/commit/c8525868de350de8b7b60cfc0a5a4c730ffe2d19
Author: Shu-yu Guo <[email protected]>
Date: 2026-05-29 (Fri, 29 May 2026)
Changed paths:
M
JSTests/stress/growable-sharedarraybuffer-parallel-grow-during-prototype-methods.js
M Source/JavaScriptCore/runtime/JSGenericTypedArrayViewPrototypeFunctions.h
Log Message:
-----------
[JSC] Use span's length in genericTypedArrayViewProtoFuncSortImpl
https://bugs.webkit.org/show_bug.cgi?id=309861
rdar://172430021
Reviewed by Yusuke Suzuki and Dan Hecht.
Constructing a span re-reads the length, which can race with a parallel grow in
case the TypedArray is backed by a GSAB. Fix the race by using the span's
length.
*
JSTests/stress/growable-sharedarraybuffer-parallel-grow-during-prototype-methods.js:
* Source/JavaScriptCore/runtime/JSGenericTypedArrayViewPrototypeFunctions.h:
(JSC::genericTypedArrayViewProtoFuncSortImpl):
Originally-landed-as: 305413.464@rapid/safari-7624.2.5.110-branch
(a5a76108f55d). rdar://176061473
Canonical link: https://commits.webkit.org/314149@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
