← WebKit — 2026-W38
125543708a962e7cae4ca21bf425787127bc9c1c [JSC] Do not crash on a TypeProfiler query with no location
severity dev
class LogicError
confidence 0.3
signal score 9
Source/JavaScriptCore/runtime
Primitive: null TypeLocation deref and offset integer overflow in $vm.findTypeForExpression
Triage note: TypeProfiler::typeInformationForExpressionAtOffset drops ASSERT(location) for runtime null checks, and JSDollarVM functionFindTypeForExpression guards find()==notFound and offset overflow plus adds exception checks. The host function is $vm (test-only harness) and TypeProfiler is inspector tooling, so dev-grade; not attacker-reachable from web content.
Triage note: TypeProfiler::typeInformationForExpressionAtOffset drops ASSERT(location) for runtime null checks, and JSDollarVM functionFindTypeForExpression guards find()==notFound and offset overflow plus adds exception checks. The host function is $vm (test-only harness) and TypeProfiler is inspector tooling, so dev-grade; not attacker-reachable from web content.
Structural signals: bounds_guard (+2.0), null_guard (+1.2), msg_medium (+2.0), area:Source/JavaScriptCore/runtime (+2.5), surgical (+1.3)
Commit message
[JSC] Do not crash on a TypeProfiler query with no location
https://bugs.webkit.org/show_bug.cgi?id=323314
rdar://187192997
Reviewed by Yusuke Suzuki.
findLocation can return null when the expression is missing or
never executed. Return empty type info instead of dereferencing
that pointer. $vm.findTypeForExpression returns null when the
substring is not in the function source.
* JSTests/typeProfiler/missing-expression.js: Added.
* Source/JavaScriptCore/runtime/TypeProfiler.cpp:
* Source/JavaScriptCore/tools/JSDollarVM.cpp:
Canonical link: https://commits.webkit.org/321203@main
Before / after
Loading diff…
On This Page