← WebKit — 2026-W38
34ccaa804ca9993edac87aa7631f26c73a018f39 [JSC] Add structuredClone to jsc shell and add more tests
severity medium
class LogicError
confidence 0.4
signal score 8.32
Source/JavaScriptCore/runtime
Primitive: missing exception checks in structured-clone array-buffer-view deserialization
Triage note: Mostly adds structuredClone() to the jsc test shell, but CloneDeserializerBase::readArrayBufferViewImpl gains DECLARE_THROW_SCOPE and RETURN_IF_EXCEPTION after readTerminal() and view->wrap(). The deserializer is attacker-reachable, and proceeding with a pending exception can corrupt state, but the change is defensive exception-check hardening rather than a demonstrated memory-safety bug.
Triage note: Mostly adds structuredClone() to the jsc test shell, but CloneDeserializerBase::readArrayBufferViewImpl gains DECLARE_THROW_SCOPE and RETURN_IF_EXCEPTION after readTerminal() and view->wrap(). The deserializer is attacker-reachable, and proceeding with a pending exception can corrupt state, but the change is defensive exception-check hardening rather than a demonstrated memory-safety bug.
Structural signals: smartptr_member_added (+4.87), null_guard (+1.95), msg_feature (-1.0), area:Source/JavaScriptCore/runtime (+2.5)
Commit message
[JSC] Add structuredClone to jsc shell and add more tests
https://bugs.webkit.org/show_bug.cgi?id=324474
rdar://187713459
Reviewed by Tadeu Zagallo, Keith Miller, and Vassili Bykov.
This patch adds structuredClone[1] function to jsc shell. This
implements the spec[2]'s behavior. It allows us to test CloneSerializer
and CloneDeserializer more easily. $262 offers broadcast function which
utilizes them, but still swallows some missing error checks due to its
thread sneding characteristics (in particular, deserializer side because
of capturing it in a different thread). Having structuredClone increases
the test coverage of CloneSerializer and CloneDeserializer.
[1]: https://developer.mozilla.org/en-US/docs/Web/API/Window/structuredClone
[2]: https://html.spec.whatwg.org/multipage/structured-data.html#dom-structuredclone
Tests: JSTests/stress/structured-clone-transfer.js
JSTests/stress/structured-clone.js
* JSTests/stress/structured-clone-transfer.js: Added.
(shouldBe):
(shouldThrow):
(throw.new.Error):
(shouldBe.let.generator):
(shouldBe.shouldThrow):
(shouldBe.get shouldBe):
(shouldBe.let.value.get detacher):
(shouldThrow.get shouldThrow):
* JSTests/stress/structured-clone.js: Added.
(shouldBe):
(shouldThrow):
(throw.new.Error):
(shouldBe.let.set structuredClone):
(shouldBe.set shouldBe):
(prototype.method):
(shouldBe.get shouldBe):
(get shouldThrow):
* Source/JavaScriptCore/jsc.cpp:
(JSC_DEFINE_HOST_FUNCTION):
* Source/JavaScriptCore/runtime/CloneDeserializerBase.h:
(JSC::CloneDeserializerBase::readArrayBufferViewImpl):
Canonical link: https://commits.webkit.org/321349@main
Before / after
Loading diff…
On This Page