Author

Erik Corry <ecorry@cloudflare.com> 2026-04-09 15:50:55 +0200

Parents

e7cd397

Tree

f364ca4

Add UAF regression test for Response body with transferred ArrayBuffer

The previous commit fixed a use-after-free where constructing a Response
from an ArrayBuffer, then transferring the buffer via structuredClone
and triggering GC, caused the Response body read to access freed backing
store memory. This adds a regression test that reproduces the original
crash (heap-use-after-free READ of size 1024 under ASAN) and verifies
the data remains intact after transfer + GC.