From 108d5c68fd7aa5f8742f0930556dc472ccdb8bc0 Mon Sep 17 00:00:00 2001 From: Karl Seguin Date: Thu, 25 Jun 2026 10:52:39 +0800 Subject: [PATCH] crash: Fix handlescope corruption on iframe load In trying to fuzz test a different issue, I ran into a reproducible case where we end up with a broken handlescope stack. The issue requires a large number of handlescopes created with aggressive GC, so hopefully it isn't something that too many users have run into. The issue is that a single HandleScope address is used to initialize two HandleScopes. The fix could just be to create a 2nd HS variable (to get a 2nd address), but the first initialization is unnecessary and can just be removed. (Note that EventManager dispatch creates its own HandleScope, so the one removed in frameCompletedLoading really did nothing) --- src/browser/Frame.zig | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-) diff --git a/src/browser/Frame.zig b/src/browser/Frame.zig index cbf031c3d..1d761224e 100644 --- a/src/browser/Frame.zig +++ b/src/browser/Frame.zig @@ -1006,11 +1006,8 @@ pub fn iframeCompletedLoading(self: *Frame, iframe: *IFrame) void { return; } - var ls: JS.Local.Scope = undefined; - self.js.localScope(&ls); - defer ls.deinit(); - - const entered = self.js.enter(&ls.handle_scope); + var hs: JS.HandleScope = undefined; + const entered = self.js.enter(&hs); defer entered.exit(); blk: {