genericTypedArrayViewProtoFuncSortImpl in Source/JavaScriptCore/runtime/JSGenericTypedArrayViewPrototypeFunctions.h implements TypedArray.prototype.sort. Sorting a typed array with a user comparator requires snapshotting the view’s backing storage into a temporary vector sized from the array length, then sorting and writing back. In the vulnerable code the function first read size_t length = thisObject->length();, used that to early-out and to size the temporary buffer (CheckedSize { length } * 2U), and only afterwards obtained auto originalSpan = thisObject->typedSpan();. When the typed array is backed by a growable SharedArrayBuffer, another agent (a Web Worker) can grow the buffer concurrently between the length() read and the typedSpan() read. That opens a time-of-check/time-of-use window: length reflects one size while originalSpan reflects a different, potentially larger extent (or the two are otherwise inconsistent), so subsequent copying and indexing driven by length no longer match the actual span, yielding out-of-bounds access relative to the snapshot.

The patch closes the window by acquiring the span first and deriving length from it: auto originalSpan = thisObject->typedSpan(); size_t length = originalSpan.size();, then doing the < 2 early-out and buffer sizing from that single consistent snapshot. This restores the invariant that the length used for allocation, iteration, and write-back is exactly the length of the span actually being operated on, eliminating the race where a parallel grow desynchronizes the two. The regression test’s added line ta.sort((a, b) => a - b); exercises exactly the comparator-driven sort path under parallel growth of a growable SharedArrayBuffer. (Inference: that the concrete faulting operation is an OOB read/write during the snapshot copy or write-back is deduced from the reordering and the test name parallel-grow-during-prototype-methods; the exact copy loop that consumes length vs. originalSpan beyond the shown lines is elsewhere in the same function.)

The primitive is a TOCTOU-induced out-of-bounds access on a temporary sort buffer whose size no longer matches the operated-on span; the attacker must win a timing race against a parallel grow, making it probabilistic rather than deterministic. The commit establishes an unexpected process crash (LogicError, medium severity) and does not demonstrate a stable, controllable OOB read/write toward RCE. It is confined to the sandboxed WebContent process running JavaScript. Practical escalation would require reliably winning the race and shaping adjacent memory, neither of which the diff shows.