You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
The structured-clone polyfill treats ArrayBuffer, DataView, and typed arrays as arbitrary objects, losing their internal data and type. Copy buffers through captured ArrayBuffer/Uint8Array intrinsics without consulting the source's constructor or species, reconstruct DataView and all 11 Hermes typed-array kinds through intrinsic constructors, and route every view buffer through clone memory so multiple views retain a shared cloned backing buffer.
[GENERAL] [FIXED] - Clone ArrayBuffers, DataViews, and typed arrays with their bytes, offsets, lengths, and shared backing buffers.
Test Plan:
Exact Hermes baseline first failed because an ArrayBuffer cloned as {}.
Fixed focused Fantom suite: 34/34 passed before the latest hardening; the updated exact-head suite is running in CI.
Regression covers distinct identity, exact constructors, and values for all 11 supported typed-array kinds; shared offset Uint8Array/DataView backing memory; buffer bytes/offsets/lengths; shadowed source slice/typed-array constructor; and an ArrayBuffer constructor getter that throws if species lookup occurs.
Fresh yarn flow-check: 0 errors.
Targeted ESLint, Prettier, an intrinsic byte-copy runtime check, and git diff --check passed.
Transfer support is unchanged and remains outside this patch. No UI change; screenshots are not applicable.
meta-claBot
added
the
CLA Signed
This label is managed by the Facebook bot. Authors need to sign the CLA before a PR can be reviewed.
label
Aug 30, 2026
The full re-review found one additional species-constructor edge case, fixed in 566f17f. ArrayBuffer.prototype.slice can still consult a source buffer's overridden constructor[Symbol.species], execute user code, and return the wrong subclass. The implementation now allocates a plain ArrayBuffer from the captured intrinsic byte-length getter and copies bytes through the captured Uint8Array intrinsic. The regression makes the source constructor getter throw, proving it is never consulted. Flow reports 0 errors; targeted ESLint, Prettier, the intrinsic-copy runtime check, and diff validation pass. Exact-head Fantom CI is now running.
The latest CI run exposed a Flow-only regression in the species-safe ArrayBuffer copy: Object.getOwnPropertyDescriptor inferred the captured byteLength getter as returning unknown. Fixed in 7065834 by supplying the descriptor's number type at the capture boundary. Full yarn flow-check now reports 0 errors; focused Prettier, ESLint, and diff validation also pass.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
CLA SignedThis label is managed by the Facebook bot. Authors need to sign the CLA before a PR can be reviewed.Shared with MetaApplied via automation to indicate that an Issue or Pull Request has been shared with the team.
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
meta-cla
Bot
added
the
CLA Signed
facebook-github-tools
Bot
added
the
Shared with Meta
Summary:
The structured-clone polyfill treats ArrayBuffer, DataView, and typed arrays as arbitrary objects, losing their internal data and type. Copy buffers through captured ArrayBuffer/Uint8Array intrinsics without consulting the source's constructor or species, reconstruct DataView and all 11 Hermes typed-array kinds through intrinsic constructors, and route every view buffer through clone memory so multiple views retain a shared cloned backing buffer.
Fixes #58218.
Changelog:
[GENERAL] [FIXED] - Clone ArrayBuffers, DataViews, and typed arrays with their bytes, offsets, lengths, and shared backing buffers.
Test Plan:
{}.slice/typed-arrayconstructor; and an ArrayBufferconstructorgetter that throws if species lookup occurs.yarn flow-check: 0 errors.git diff --checkpassed.Transfer support is unchanged and remains outside this patch. No UI change; screenshots are not applicable.