Branch: refs/heads/webkitglib/2.50
Home: https://github.com/WebKit/WebKit
Commit: 512127005dc636d7ff981ca12d2b83b9bb6a021d
https://github.com/WebKit/WebKit/commit/512127005dc636d7ff981ca12d2b83b9bb6a021d
Author: Sosuke Suzuki <[email protected]>
Date: 2025-11-25 (Tue, 25 Nov 2025)
Changed paths:
A JSTests/stress/null-butterfly-checking.js
M Source/JavaScriptCore/runtime/Structure.cpp
Log Message:
-----------
Cherry-pick 303524@main (8fbefe5287a8).
https://bugs.webkit.org/show_bug.cgi?id=303015
[JSC] Fix UBSan crash for null butterfly
https://bugs.webkit.org/show_bug.cgi?id=303015
Reviewed by Yusuke Suzuki.
This patch changes to add null checking for butterfly for fixing UBSan
crash like:
```
runtime/Structure.cpp:1042:41: runtime error: member call on null pointer
of type 'JSC::Butterfly'
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior
runtime/Structure.cpp:1042:41
/Users/sosukesuzuki/ghq/github.com/WebKit/WebKit/Source/JavaScriptCore/runtime/Butterfly.h:182:21:
runtime error: member call on null pointer of type 'JSC::Butterfly *'
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior
/Users/sosukesuzuki/ghq/github.com/WebKit/WebKit/Source/JavaScriptCore/runtime/Butterfly.h:182:21
/Users/sosukesuzuki/ghq/github.com/WebKit/WebKit/Source/JavaScriptCore/runtime/IndexingHeader.h:74:61:
runtime error: applying non-zero offset 18446744073709551608 to null pointer
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior
/Users/sosukesuzuki/ghq/github.com/WebKit/WebKit/Source/JavaScriptCore/runtime/IndexingHeader.h:74:61
runtime/Structure.cpp:1043:33: runtime error: member call on null pointer
of type 'JSC::Butterfly'
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior
runtime/Structure.cpp:1043:33
/Users/sosukesuzuki/ghq/github.com/WebKit/WebKit/Source/JavaScriptCore/runtime/Butterfly.h:222:11:
runtime error: member call on null pointer of type 'JSC::Butterfly *'
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior
/Users/sosukesuzuki/ghq/github.com/WebKit/WebKit/Source/JavaScriptCore/runtime/Butterfly.h:222:11
/Users/sosukesuzuki/ghq/github.com/WebKit/WebKit/Source/JavaScriptCore/runtime/Butterfly.h:184:21:
runtime error: member call on null pointer of type 'JSC::Butterfly *'
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior
/Users/sosukesuzuki/ghq/github.com/WebKit/WebKit/Source/JavaScriptCore/runtime/Butterfly.h:184:21
```
* JSTests/stress/null-butterfly-checking.js: Added.
(const.v3.p):
* Source/JavaScriptCore/runtime/Structure.cpp:
(JSC::Structure::flattenDictionaryStructure):
Canonical link: https://commits.webkit.org/303524@main
Canonical link: https://commits.webkit.org/298234.306@webkitglib/2.50
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
