Files
ladybird/Libraries/LibJS/Runtime
Yayoi-cs 0b9636fadf LibJS: Only cache TypedArray data pointers for owned buffers
WebAssembly.Memory-backed ArrayBuffers wrap external
ByteBuffer storage. When that memory grows,
ByteBuffer::try_resize() may realloc the backing storage while
old fixed-length buffer objects remain reachable from JS.

TypedArrayBase cached m_data for all fixed-length buffers, and
the asm interpreter fast path dereferenced that cached pointer
directly. For wasm memory views this could leave a stale
pointer behind across grow().

Restrict cached typed-array data pointers to fixed-length
ArrayBuffers that own stable ByteBuffer storage.
External/unowned buffers, including WebAssembly.Memory
buffers, now keep m_data == nullptr and fall back to code that
re-derives buffer().data() on each access.

Add regressions for both the original shared-memory grow case
and the second-grow stale-view case.
2026-04-25 06:11:18 +02:00
..
2026-03-19 21:55:10 -05:00
2026-03-20 12:03:36 +01:00
2026-02-26 13:54:35 -05:00
2026-04-03 21:21:09 +02:00
2026-03-20 12:03:36 +01:00