mirror of
https://github.com/vercel-labs/scriptc.git
synced 2026-10-26 06:34:20 +08:00
Malte UblandClaude Opus 5.5
6eb11bf7f4
A record shape that is an arm of a union of records carries a hidden shape word at struct index 1, so its fields start at index 2. The new program keeps such records in frame storage while they own string and array fields, reads and writes those fields, passes the shapes through the union, compares identities and serializes them. With the frame storage's reference-field slots addressed at index + 1 instead of the shape's field base, the compiled program segfaults in the plain lane and ASan reports a heap-buffer-overflow in the sanitized one. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>