Created attachment 228233 [details] HTML file with javascrpt that reproduces the bug Typed arrays are being initialized filled with garbage, not zeros. For example: var r = new Int32Array(38); r Int32Array(38) [-399179776, -1610579712, 399179775, 1610579711, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0] See attached html file with javascript within for a test case. To reproduce the bug, open Chromium, then open devtools. Load the attached HTML page. It will give you instructions, which boil down to executing the above two commands, then refreshing the page and repeating until you find that the array "r" was initialized with garbage. This is a show-stopping bug: My company's complex javascript application completely fails to run because its data arrays get corrupted as above.
uname -a FreeBSD [machine.name] 12.2-RELEASE-p10 FreeBSD 12.2-RELEASE-p10 #2 r367038M: Tue Sep 28 08:28:54 EDT 2021 root@[machine.name]:/usr/obj/usr/src/amd64.amd64/sys/GENERIC amd64
Sorry that was typed in haste... "It will give you instructions..." means "Please see the console log".
Created attachment 228345 [details] Same repro rewritten for convenience This should be a bit more appropriate.
Seems to be reproducible in v92, will test it with v94 when porting is done, and try to chase it there.
Any update on this?
(In reply to jschachter@spendata.com from comment #5) Unable to reproduce anymore with the reproducer. Please re-test.
I can confirm that Chromium 99.0.4844.82 works fine now. Not only does the bug no longer happen in Alex's repro code, but my company's javascript application works 100% again. Thanks to whomever fixed this!