Skip to content

fix: prevent assertion crash when SharedArrayBuffer-backed views reach unsharedBuffer()#27318

Open
robobun wants to merge 2 commits intomainfrom
toaster/fix-unsharedbuffer-shared-assertion
Open

fix: prevent assertion crash when SharedArrayBuffer-backed views reach unsharedBuffer()#27318
robobun wants to merge 2 commits intomainfrom
toaster/fix-unsharedbuffer-shared-assertion

Conversation

@robobun
Copy link
Collaborator

@robobun robobun commented Feb 21, 2026

Crash

Assertion failure in JSArrayBufferView::unsharedBuffer() when a typed array backed by a SharedArrayBuffer is passed through a code path that assumes unshared buffers.

Reproduction

const sab = new SharedArrayBuffer(8);
const view = new Uint8Array(sab);
const stream = new ReadableStream({
  start(controller) {
    controller.enqueue(view);
    controller.close();
  }
});
const resp = new Response(stream);
const clone = resp.clone();
await clone.arrayBuffer();

Root Cause

structuredCloneForStream in StructuredClone.cpp calls bufferView->unsharedBuffer() without checking whether the view is backed by a SharedArrayBuffer. The unsharedBuffer() method asserts !result || !result->isShared(), so passing a shared-buffer-backed view triggers a crash. The same pattern exists in BunIDLConvert.h's IDLArrayBufferRef converter, which is used by the bindgen system for APIs accepting ArrayBuffer arguments.

Fix

  • In StructuredClone.cpp: check bufferView->isShared() before calling unsharedBuffer() and throw a DataCloneError if shared.
  • In BunIDLConvert.h: check isShared() on JSArrayBufferView and JSDataView before calling unsharedBuffer(), returning std::nullopt (conversion failure) if shared.

Verification

  • Reproduction no longer crashes (throws DataCloneError instead)
  • Added regression test at test/js/web/streams/shared-array-buffer-clone.test.ts

@robobun
Copy link
Collaborator Author

robobun commented Feb 21, 2026 •
edited
Loading

Updated 9:21 PM PT - Feb 20th, 2026

❌ @autofix-ci[bot], your commit 9ff0462 has 13 failures in Build #37795 (All Failures):

🧪   To try this PR locally:

bunx bun-pr 27318

That installs a local version of the PR into your bun-27318 executable, so you can run:

bun-27318 --bun

@coderabbitai
Copy link
Contributor

coderabbitai bot commented Feb 21, 2026 •
edited
Loading

No actionable comments were generated in the recent review. 🎉

Walkthrough

Adds checks to reject cloning of shared ArrayBufferViews in two conversion paths: IDL conversion rejects them during conversion, and structured cloning throws a DataCloneError. Includes a test verifying Response.clone() handles SharedArrayBuffer-backed views without crashing.

Changes

Cohort / File(s) Summary
SharedArrayBuffer rejection guards
src/bun.js/bindings/BunIDLConvert.h, src/bun.js/bindings/webcore/StructuredClone.cpp		 Add early-return guards to reject cloning of shared ArrayBufferViews. BunIDLConvert.h rejects shared views during IDL conversion by returning std::nullopt; StructuredClone.cpp throws a DataCloneError for shared views in structured cloning.
Test coverage
test/js/web/streams/shared-array-buffer-clone.test.ts		 New test file verifying Response.clone() does not crash when processing a ReadableStream containing SharedArrayBuffer-backed Uint8Array, expecting a DataCloneError instead.
🚥 Pre-merge checks | ✅ 2
✅ Passed checks (2 passed)
Check name Status Explanation
Title check ✅ Passed The title clearly describes the main fix: preventing assertion crashes when SharedArrayBuffer-backed views reach unsharedBuffer(), which aligns with the primary changes in the codebase.
Description check ✅ Passed The PR description follows the template with clear sections covering what the PR does (Crash, Root Cause, Fix) and verification details, though it exceeds the template structure slightly.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.

Comment @coderabbitai help to get the list of available commands and usage tips.

@claude
Copy link
Contributor

claude bot commented Feb 21, 2026

✅ 9ff04 — Looks good!

Reviewed 3 files across src/bun.js/bindings/ and test/js/web/streams/: adds isShared() checks before calling unsharedBuffer() in StructuredClone.cpp and BunIDLConvert.h to prevent assertion crashes when SharedArrayBuffer-backed typed arrays are used in stream cloning, throwing DataCloneError instead of crashing.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

claude

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@robobun @claude