← WebKit — 2026-W37
b6afe0d39e0a Error.stack carries the whole script when the script came from a data: URL
not a security fix
confidence 0.12
signal score 7.05
Source/JavaScriptCore/runtime
Classified as not security-relevant.
Triage note: StackFrame::toString adds truncateLongDataURL to cap data: source URLs at 1024 chars in stack traces (percent-escape aware) and keeps fullSourceURL alive for the StringView. This is a display/resource cap (Sentry parity) with correct lifetime handling; no memory-safety or logic security bug is fixed.
This commit was flagged by the signal scorer and reviewed by AI (not a human). It is listed only so the triage is auditable; there is no root-cause analysis because this is not a vulnerability fix.
Triage note: StackFrame::toString adds truncateLongDataURL to cap data: source URLs at 1024 chars in stack traces (percent-escape aware) and keeps fullSourceURL alive for the StringView. This is a display/resource cap (Sentry parity) with correct lifetime handling; no memory-safety or logic security bug is fixed.
This commit was flagged by the signal scorer and reviewed by AI (not a human). It is listed only so the triage is auditable; there is no root-cause analysis because this is not a vulnerability fix.
Structural signals: bounds_guard (+3.25), area:Source/JavaScriptCore/runtime (+2.5), surgical (+1.3)
Before / after
Loading diff…
On This Page