From 10b60b8cd3379f87add484feddc8996e59ed90cd Mon Sep 17 00:00:00 2001
From: Chris Tate <chris@ctate.dev>
Date: Mon, 28 Sep 2026 12:14:04 -0500
Subject: [PATCH] Propagate typed-array accessor failures

---
 packages/runtime/src/scr_bytes.c                  | 2 ++
 tests/corpus/3121-dynamic-accessor-descriptors.js | 6 ++++++
 2 files changed, 8 insertions(+)

diff --git a/packages/runtime/src/scr_bytes.c b/packages/runtime/src/scr_bytes.c
index 60557d2d8..c76c9c479 100644
--- a/packages/runtime/src/scr_bytes.c
+++ b/packages/runtime/src/scr_bytes.c
@@ -301,6 +301,7 @@ static bool scr_bytes_source_length(const ScrDyn *value, double *length) {
   case SCR_DYN_STR: *length = scr_str_utf16_len(value->v.str); return true;
   case SCR_DYN_OBJ: {
     ScrDyn *v = scr_dyn_obj_read(value, "length", 6);
+    if (!v) return false;
     double n;
     bool ok = scr_dyn_number_coerce_js(v, &n);
     scr_dyn_release(v);
@@ -336,6 +337,7 @@ static ScrDyn *scr_bytes_source_at(const ScrDyn *value, size_t i) {
 static bool scr_bytes_copy_array_like(ScrBytes *dst, const ScrDyn *src, size_t offset, size_t count) {
   for (size_t i = 0; i < count; i++) {
     ScrDyn *value = scr_bytes_source_at(src, i);
+    if (!value) return false;
     double number;
     bool ok = scr_dyn_number_coerce_js(value, &number);
     scr_dyn_release(value);
diff --git a/tests/corpus/3121-dynamic-accessor-descriptors.js b/tests/corpus/3121-dynamic-accessor-descriptors.js
index 84dbdd851..1e6134d40 100644
--- a/tests/corpus/3121-dynamic-accessor-descriptors.js
+++ b/tests/corpus/3121-dynamic-accessor-descriptors.js
@@ -45,6 +45,12 @@ function customToJSON() { return { ready: 5 }; }
 function getToJSON() { toJSONReads++; return customToJSON; }
 Object.defineProperty(customJSON, 'toJSON', { get: getToJSON });
 console.log(JSON.stringify(customJSON, identityReplacer), toJSONReads);
+const badLength = JSON.parse('{}');
+Object.defineProperty(badLength, 'length', { get: explode });
+try { new Uint8Array(badLength); } catch (error) { console.log(error.name, error.message); }
+const badIndex = JSON.parse('{"length":1}');
+Object.defineProperty(badIndex, '0', { get: explode });
+try { Uint8Array.from(badIndex); } catch (error) { console.log(error.name, error.message); }
 const source = JSON.parse('{}');
 Object.defineProperty(source, 'shared', { get: getStored, enumerable: true });
 const destination = JSON.parse('{}');