Upgrade WebKit to 2603e9eb41f0 - #34373
Merged
Merged
Claude / Claude Code Review
completed
Jul 17, 2026 in 25m 55s
Code review found 1 important issue
Found 1 candidates, confirmed 1. See review comments for details.
Details
| Severity | Count |
|---|---|
| 🔴 Important | 1 |
| 🟡 Nit | 0 |
| 🟣 Pre-existing | 0 |
| Severity | File:Line | Issue |
|---|---|---|
| 🔴 Important | src/jsc/bindings/webcore/SerializedScriptValue.cpp:6406-6411 |
Dropping the isLocked() gate makes WebAssembly.Memory buffers silently copy on transfer instead of throwing |
Annotations
Check failure on line 6411 in src/jsc/bindings/webcore/SerializedScriptValue.cpp
claude / Claude Code Review
Dropping the isLocked() gate makes WebAssembly.Memory buffers silently copy on transfer instead of throwing
Dropping the `isLocked()` gate entirely also stops rejecting `WebAssembly.Memory` buffers, which JSC marks with the lock flag (`makeWasmMemory()` → `pinAndLock()`). Before this PR, `structuredClone(new WebAssembly.Memory({initial:1}).buffer, {transfer:[buf]})` threw `errorMessageForTransfer`'s "Cannot transfer a WebAssembly.Memory" TypeError — matching the HTML spec (mismatched `[[ArrayBufferDetachKey]]` must throw), Node.js, and browsers; after, `transferTo()`'s `copyTo()` fallback silently ret
Loading