[arraybuffers] initialize max byte length of empty array buffers

joyeecheung · V8 LUCI CQ · commit e061cf9970d9 · 2024-07-02T06:27:14.000Z
Without initializing the max byte length field, any empty array buffer captured in the snapshot can make the snapshot unreproducible. Refs: nodejs/node#53579 Change-Id: I2489ab2e57ecbb405ec431a87d0acc92822b777c Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5662576 Reviewed-by: Marja Hölttä <marja@chromium.org> Commit-Queue: Marja Hölttä <marja@chromium.org> Cr-Commit-Position: refs/heads/main@{#94754}
diff --git a/src/builtins/builtins-typed-array-gen.cc b/src/builtins/builtins-typed-array-gen.cc
@@ -69,6 +69,8 @@ TNode<JSArrayBuffer> TypedArrayBuiltinsAssembler::AllocateEmptyOnHeapBuffer(
                                  UndefinedConstant());
   StoreBoundedSizeToObject(buffer, JSArrayBuffer::kRawByteLengthOffset,
                            UintPtrConstant(0));
+  StoreBoundedSizeToObject(buffer, JSArrayBuffer::kRawMaxByteLengthOffset,
+                           UintPtrConstant(0));
   StoreSandboxedPointerToObject(buffer, JSArrayBuffer::kBackingStoreOffset,
                                 EmptyBackingStoreBufferConstant());
 #ifdef V8_COMPRESS_POINTERS
