`Crypto::Subtle.constant_time_compare` does not work with `StaticArray` / Cannot overwrite `StaticArray` variable about crystal HOT 2 OPEN

Yes, problem lies in the assignment x = x.to_slice. StaticArray#to_slice takes a pointer of itself. So x.to_slice points to the location of x on the stack. By assigning the resulting slice to x again, you're overriding that memory with the instance of Slice which now points to itself.

Reduced example:

ary = StaticArray[1, 2, 3, 4]
slice = ary.to_slice

slice # => Slice[1, 2, 3, 4]

# now overwrite the memory location of `ary` with a new value
ary = StaticArray[5, 6, 7, 8]

slice # => Slice[5, 6, 7, 8]

This is obviously a foot gun.
StaticArray#to_slice is unsafe because it takes a stack pointer. It should be renamed to #to_unsafe_slice. This has been discussed previously in #9606 and there's already a patch in #11031. I'll extract the part for StaticArray#to_unsafe_slice from that PR which seems to be uncontested.

from crystal.

Another relevant example could be HTTP::WebSocket::Protocol#close, which does this with message:

The public method has no type restriction on message, so someone could footgun themselves:

from crystal.