Bug 257737

Summary: Speculative crash in WebCoreTypedArrayController::registerWrapper when JSGlobalObject* is not a JSDOMGlobalObject
Product: WebKit Reporter: Jarred Sumner <jarred>
Component: JavaScriptCoreAssignee: Nobody <webkit-unassigned>
Status: RESOLVED INVALID    
Severity: Normal CC: cdumez, joseph.j.griego, mark.lam, webkit-bug-importer, ysuzuki
Priority: P2 Keywords: InRadar
Version: WebKit Nightly Build   
Hardware: Unspecified   
OS: Unspecified   

Description Jarred Sumner 2023-06-05 18:37:38 PDT
The following line segfaults if it becomes possible for JSC::JSGlobalObject* to not be a JSDOMGlobalObject* in WebCore. For example, if ShadowRealm returns a non-JSDOMGlobalObject.

```
void WebCoreTypedArrayController::registerWrapper(JSC::JSGlobalObject* globalObject, JSC::ArrayBuffer* native, JSC::JSArrayBuffer* wrapper)
{
    cacheWrapper(JSC::jsCast<JSDOMGlobalObject*>(globalObject)->world(), native, wrapper);
}
```

This code was copied into Bun and in Bun's case, the Node.js "vm" module can be used to return an `ArrayBuffer` constructed in a different realm which is not a JSDOMGlobalObject*, so `require('vm').runInNewContext("new ArrayBuffer(42)")` segfaulted

https://github.com/oven-sh/bun/blob/17bca62df10008b2d252d5b63bd9b028e9fcd1c0/src/bun.js/bindings/webcore/WebCoreTypedArrayController.cpp#L54-L57
Comment 1 Radar WebKit Bug Importer 2023-06-12 18:38:15 PDT
<rdar://problem/110679562>
Comment 2 Yusuke Suzuki 2023-06-15 14:49:24 PDT
I don't think this is an issue. WebCore is adding a hook, so WebCore always creates JSDOMGlobalObject-derived shadow realm. So this condition is always met.
See `ShadowRealmGlobalScope` and `deriveShadowRealmGlobalObject`.