Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: a0e2a50e76fc30f448bc87fa21c4cad392561697
https://github.com/WebKit/WebKit/commit/a0e2a50e76fc30f448bc87fa21c4cad392561697
Author: Sosuke Suzuki <[email protected]>
Date: 2026-09-15 (Tue, 15 Sep 2026)
Changed paths:
A JSTests/stress/varargs-cloned-arguments-length-over-uint32.js
M Source/JavaScriptCore/interpreter/Interpreter.cpp
Log Message:
-----------
[JSC] `sizeOfVarargs` truncates a strict arguments object's length to 32 bits
https://bugs.webkit.org/show_bug.cgi?id=324226
Reviewed by Yusuke Suzuki.
When the length of a strict arguments object has been overwritten with a
value of 2^32 or more, passing it to a varargs call uses only the low 32 bits
of that length:
function f() {
"use strict";
arguments.length = 2 ** 32 + 1;
return g.apply(null, arguments);
}
calls g with one argument instead of throwing a RangeError.
ClonedArguments::length() returns uint64_t, and sizeOfVarargs() stores it in
an unsigned before comparing it with maxArguments. This patch clamps it
first, as the generic array-like case in the same function already does.
Test: JSTests/stress/varargs-cloned-arguments-length-over-uint32.js
* JSTests/stress/varargs-cloned-arguments-length-over-uint32.js: Added.
(shouldThrow):
(makeArguments):
(apply):
(reflectApply):
* Source/JavaScriptCore/interpreter/Interpreter.cpp:
(JSC::sizeOfVarargs):
Canonical link: https://commits.webkit.org/321213@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
