StringOrBuffer: snapshot resizable ArrayBuffer inputs so a later arg cannot resize(0) through the borrow - #35821
Open
robobun wants to merge 5 commits into
Open
StringOrBuffer: snapshot resizable ArrayBuffer inputs so a later arg cannot resize(0) through the borrow#35821robobun wants to merge 5 commits into
robobun wants to merge 5 commits into
Claude / Claude Code Review
completed
Jul 26, 2026 in 34m 26s
Code review found 1 potential issue
Found 1 candidates, confirmed 1. See review comments for details.
Details
| Severity | Count |
|---|---|
| 🔴 Important | 0 |
| 🟡 Nit | 1 |
| 🟣 Pre-existing | 0 |
| Severity | File:Line | Issue |
|---|---|---|
| 🟡 Nit | src/runtime/node/types.rs:393-396 |
VectorArrayBuffer (fs.writev/readv) has the same resize() hole; not listed as an exclusion |
Annotations
Check warning on line 396 in src/runtime/node/types.rs
claude / Claude Code Review
VectorArrayBuffer (fs.writev/readv) has the same resize() hole; not listed as an exclusion
🟡 `VectorArrayBuffer::from_js` (same file, used by `fs.writev`/`fs.readv` via `FdVectorIo::from_js` at node_fs.rs:2817) has the identical `resize()` hole this PR fixes for `StringOrBuffer`: `Bun__JSArray__collectBufferSpans` pins each element then captures `(view->vector(), view->byteLength())` into an iovec with no resizable check, so `buf.buffer.resize(0)` after `fs.writev(fd, [buf], cb)` returns mprotects the pages `PROT_NONE` and the threadpool `writev` SIGSEGVs — the direct analog of the `f
Loading