## Summary
- Fix crash in `FormData.from()` when called with very large ArrayBuffer
input
- Add length check in C++ `toString` function against both Bun's
synthetic limit and WebKit's `String::MaxLength`
- For UTF-8 tagged strings, use simdutf to calculate actual UTF-16
length only when byte length exceeds the limit
## Root Cause
When `FormData.from()` was called with a very large ArrayBuffer (e.g.,
`new Uint32Array(913148244)` = ~3.6GB), the code would crash with:
```
ASSERTION FAILED: data.size() <= MaxLength
vendor/WebKit/Source/WTF/wtf/text/StringImpl.h(886)
```
The `toString()` function in `helpers.h` was only checking against
`Bun__stringSyntheticAllocationLimit` (which defaults to ~4GB), but not
against WebKit's `String::MaxLength` (INT32_MAX, ~2GB). When the input
exceeded `String::MaxLength`, `createWithoutCopying()` would fail with
an assertion.
## Changes
1. **helpers.h**: Added `|| str.len > WTF::String::MaxLength` checks to
all three code paths in `toString()`:
- UTF-8 tagged pointer path (with simdutf length calculation only when
needed)
- External pointer path
- Non-copying creation path
2. **url.zig**: Reverted the incorrect Zig-side check (UTF-8 byte length
!= UTF-16 character length)
## Test plan
- [x] Added test that verifies FormData.from with oversized input
doesn't crash
- [x] Verified original crash case now returns empty FormData instead of
crashing:
```js
const v3 = new Uint32Array(913148244);
FormData.from(v3); // No longer crashes
```
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-authored-by: Claude Bot <claude-bot@bun.sh>
Co-authored-by: Claude <noreply@anthropic.com>
Co-authored-by: Jarred Sumner <jarred@jarredsumner.com>
* remove while loops where a for would be more efficient
* this needs to be a stack copy
* this can use the better loop
* this was translated wrong
---------
Co-authored-by: Jarred Sumner <709451+Jarred-Sumner@users.noreply.github.com>
* chore: upgrade zig to 0.12.0-dev.1828+225fe6ddb
* open as iterable
* fix building identifier cache
* fix windows build
* fix linux build
* fix linux build
* Use debug mode by default
* Enable build with assertions enabled
* Update cli.zig
* Update bun-linux-build.yml
* Fixes
* Fix `ASSERT_ENABLED`
* try this
* Update Dockerfile
* mimalloc debug
* Update CMakeLists.txt
* `Bun.deepMatch` - fix assertion failures
cc @dylan-conway, looks like we need to use `putDirectMayBeIndex` and check for `isCell` more carefully.
* Object.create support in code generator and callbacks wrapper
* Remove unused file
* zig upgrade
* zls
* Fix various errors
* Support `BuiltinAccessor` in create_hash_table script
* Fix assertion failure in `process.mainModule`
* Fix assertion failure in `onerror`
* Fix assertion failure when creating a Worker
* Fix asssertion failure when loading lots of files in bun test
* Fix assertion failure when termating a `Worker`
* Add helper for converting BunString to a WTFString
* Fix assertion failure in notifyNeedTermination
* Add more debug logs in `bun test`
* Fix compiler warning in usockets
* Fix assertion failure with `Worker` termination (another)
* Fix assertion failure in `coerceToInt64`
* Fix assertion failure in `BroadcastChannel`
* Fix assertion failure in `Headers.prototype.getAll`
* Fixes#7067
* Add heap analyzer label for CommonJS modules
* Fix assertion failure in module.require && module.require.resolve
* Remove unused code
* Fix assertion failure in debugger
* Fix crash in debugger
* Fix assertion failures in bun:sqlite
* Bump zig
* Bump WebKit
* Fix assertion failure in JSPromise::reject && JSInternalPromise::reject
* Fix assertion failure in ReadableStream::cancel
* Fix assertion failure in AsyncContextFrame::create
* Fix assertion failure in bun:sqlite
* Fix assertion failure in mocks
* Fix assertion failure in ServerWebSocket.close
* Fix assertion failure in N-API with subclasses
* [napi] Make promises cheaper
* undo
* Don't check for exceptions in ObjectInitializationScope
* Add separate entry point for test runner that doesn't generate code
* Don't deref builtin code
* Fix preload test
* Fix assertion failure in memoryUsage()
* Fix preload test, part 2
* Ensure that the env map for a Worker is empty after it is used
* The pointer for the Arena allocator used in parsing should not change
* Terminate thread on exit
* Start to implement scriptExecutionStatus
* Update worker.test.ts
* Fix Dirent.name setter
* Update settings.json
* Fix assertion failure in node:http
* Use correct value for `JSFinalObject::maxInlineCapacity`
* JSFinalObject::maxInlineCapacity x2
* Don't strip when assertions are enabled
* Make `m_wasTerminated` atomic
* Preserve directives in the transpiler
cc @ctjlewis
* Workaround assertion failure in ServerWebSocket.sendBinary and ServerWebSocket.sendText
* windows
* Buffer lockfile serialization in-memory
* PR feedback
* PR feedback
* PR feedback
* Windows
* quotes
* Update CMakeLists.txt
* Update bun-linux-build.yml
* Update bun-linux-build.yml
* Move this code to BunString.cpp
* Update BunString.cpp
---------
Co-authored-by: Jarred Sumner <709451+Jarred-Sumner@users.noreply.github.com>
* added some improvements on server
* undo unintended change
* clean data handler before end calls
* refactor
* make ctx.resp nullable
---------
Co-authored-by: Jarred Sumner <jarred@jarredsumner.com>
