IntegerOverflow 13 commits

Integer wraparound as the root cause — even when it later manifests as OOB.

2026-W31 2026-08-01 – 07

2026-W26 2026-06-27 – 07-03

  • ExpressionInfo::Encoder computes the offset to Extension Islands incorrectly.
    JSC 449c42b27f 2026-07-01
  • Change IPInt m_pendingOffset to std::optional and add metadata offset overflow assertions
    JSC b44e37ce8f 2026-07-01
  • uint32 Wraparound in vsUintIndexClamp Leads to GPU OOB Read
    WebGPU 0077500fa5 2026-07-01 ↑ boundary
  • Add size limit to Yarr generated code
    JSC 0012e6118d 2026-06-30
  • [WebGPU] signed-negation overflow on baseVertex==INT32_MIN in RenderPassEncoder::clampIndexBufferToValidValues
    WebGPU 543f99d9d3 2026-06-30 ↑ boundary
  • MockSampleBox should not have negative timeScales and duration
    WebCore 82a21e0b3e 2026-06-30

2026-W24 2026-06-13 – 19

2026-W23 2026-06-06 – 12

  • Undefined left-shift in AV1 readULEBSize()
    WebCore 74eb1295e2 2026-06-10

2026-W22 2026-05-30 – 06-05

2026-W21 2026-05-23 – 29

  • Integer underflow leads to crash in ComputeH264InfoFromAVC
    WebCore 86f9503e09 2026-05-28 ↑ boundary