Fix crash issues

src/builtins/BuiltinTypedArray.cpp

@@ -485,7 +485,9 @@ static Value builtinTypedArrayCopyWithin(ExecutionState& state, Value thisValue,
         // Set len to TypedArrayLength(taRecord).
         len = O->arrayLength();
         // Set count to min(count, len - startIndex, len - targetIndex).
-        count = std::min(std::min(count, len - startIndex), len - targetIndex);
+        // NOTE: After buffer resize during argument coercion, len - startIndex or len - targetIndex can be negative.
+        // We must clamp count to non-negative to prevent integer underflow when casting to size_t.
+        count = std::max(0.0, std::min(std::min(count, len - startIndex), len - targetIndex));
         // Let typedArrayName be the String value of O.[[TypedArrayName]].
         // Let elementSize be the Number value of the Element Size value specified in Table 59 for typedArrayName.
         size_t elementSize = O->elementSize();

src/runtime/DataViewObject.h

@@ -90,8 +90,8 @@ class DataViewObject : public ArrayBufferView {
             ErrorObject::throwBuiltinError(state, ErrorCode::RangeError, state.context()->staticStrings().DataView.string(), false, String::emptyString(), ErrorObject::Messages::GlobalObject_InvalidArrayBufferOffset);
         }
 
+        // Perform coercion first before any buffer state checks
         auto numericValue = val.toNumeric(state);
-        UNUSED_VARIABLE(numericValue);
 
         bool isLittleEndian = _isLittleEndian.toBoolean();
         throwTypeErrorIfDetached(state);
@@ -105,7 +105,8 @@ class DataViewObject : public ArrayBufferView {
         }
 
         size_t bufferIndex = numberIndex + viewOffset;
-        buffer()->setValueInBuffer(state, bufferIndex, type, val, isLittleEndian);
+        // Pass the already-coerced numeric value to prevent re-coercion in setValueInBuffer
+        buffer()->setValueInBuffer(state, bufferIndex, type, numericValue.first, isLittleEndian);
     }
 };
 } // namespace Escargot

src/runtime/JSON.cpp

@@ -83,6 +83,30 @@ struct JSONStringStream {
     const Ch* tail_;
 };
 
+template <typename JSONCharType>
+class JSONDocument : public rapidjson::GenericDocument<JSONCharType> {
+public:
+    JSONDocument(ExecutionState& state)
+        : m_state(state)
+    {
+    }
+
+    bool StartObject()
+    {
+        CHECK_STACK_OVERFLOW(m_state);
+        return rapidjson::GenericDocument<JSONCharType>::StartObject();
+    }
+
+    bool StartArray()
+    {
+        CHECK_STACK_OVERFLOW(m_state);
+        return rapidjson::GenericDocument<JSONCharType>::StartArray();
+    }
+
+private:
+    ExecutionState& m_state;
+};
+
 template <typename CharType, typename JSONCharType>
 static Value parseJSONWorker(ExecutionState& state, const rapidjson::GenericValue<JSONCharType>& value)
 {
@@ -156,12 +180,12 @@ static Value parseJSONWorker(ExecutionState& state, const rapidjson::GenericValu
 }
 
 template <typename CharType, typename JSONCharType>
-static Value parseJSON(ExecutionState& state, const CharType* data, size_t length, rapidjson::GenericDocument<JSONCharType>& jsonDocument)
+static Value parseJSON(ExecutionState& state, const CharType* data, size_t length, JSONDocument<JSONCharType>& jsonDocument)
 {
     auto strings = &state.context()->staticStrings();
 
     JSONStringStream<JSONCharType> stringStream(data, length);
-    jsonDocument.ParseStream(stringStream);
+    jsonDocument.template ParseStream<rapidjson::kParseDefaultFlags, JSONCharType, JSONStringStream<JSONCharType>, JSONDocument<JSONCharType>>(stringStream);
     if (jsonDocument.HasParseError()) {
         ErrorObject::throwBuiltinError(state, ErrorCode::SyntaxError, strings->JSON.string(), true, strings->parse.string(), rapidjson::GetParseError_En(jsonDocument.GetParseError()));
     }
@@ -197,7 +221,7 @@ Value JSON::parse(ExecutionState& state, Value text, Value reviver)
 
     // 1, 2, 3
     String* JText = text.toString(state);
-    rapidjson::GenericDocument<rapidjson::UTF16<char16_t>> parseResult;
+    JSONDocument<rapidjson::UTF16<char16_t>> parseResult(state);
     Value unfiltered;
     if (JText->has8BitContent()) {
         size_t len = JText->length();

third_party/rapidjson/include/rapidjson/document.h

@@ -2063,6 +2063,26 @@ class GenericDocument : public GenericValue<Encoding, Allocator> {
 
     //!@name Parse from stream
     //!@{
+    //! Parse JSON text from an input stream (with Encoding conversion)
+    /*! \tparam parseFlags Combination of \ref ParseFlag.
+        \tparam SourceEncoding Encoding of input stream
+        \tparam InputStream Type of input stream, implementing Stream concept
+        \param is Input stream to be parsed.
+        \return The document itself for fluent API.
+    */
+    template <unsigned parseFlags, typename SourceEncoding, typename InputStream, typename Handler>
+    GenericDocument& ParseStream(InputStream& is)
+    {
+        ValueType::SetNull(); // Remove existing root if exist
+        GenericReader<SourceEncoding, Encoding, StackAllocator> reader(&stack_.GetAllocator());
+        ClearStackOnExit scope(*this);
+        parseResult_ = reader.template Parse<parseFlags>(is, (Handler&)*this);
+        if (parseResult_) {
+            RAPIDJSON_ASSERT(stack_.GetSize() == sizeof(ValueType)); // Got one and only one root object
+            this->RawAssign(*stack_.template Pop<ValueType>(1)); // Add this-> to prevent issue 13.
+        }
+        return *this;
+    }
 
     //! Parse JSON text from an input stream (with Encoding conversion)
     /*! \tparam parseFlags Combination of \ref ParseFlag.
@@ -2189,7 +2209,7 @@ class GenericDocument : public GenericValue<Encoding, Allocator> {
     //! Get the capacity of stack in bytes.
     size_t GetStackCapacity() const { return stack_.GetCapacity(); }
 
-private:
+protected:
     // clear stack on any exit from ParseStream, e.g. due to exception
     struct ClearStackOnExit {
         explicit ClearStackOnExit(GenericDocument& d)