MemoryCorruption
10 commits
Double-free, arbitrary write not tied to OOB, heap metadata corruption.
2026-W29 2026-07-18 – 24
2026-W26 2026-06-27 – 07-03
- [JSC] DFGArgumentsEliminationPhase removeViaKill should reset node scan index between InlineCallFrames
2026-W25 2026-06-20 – 26
2026-W24 2026-06-13 – 19
2026-W23 2026-06-06 – 12
- [JSC] BBQJIT tail call shuffle should detect overlapping stack slots
- REGRESSION(305199@main): Crash in `SourceBufferPrivate::removeCodedFramesInternal`
- [JSC] Fix incorrect handling of unwritten slots in operationPopulateObjectInOSR for PhantomNewArrayWithButterfly
2026-W22 2026-05-30 – 06-05
- Fix baseline write barrier handling in OpDelBy{Id,Val}
2026-W20 2026-05-16 – 22
- [JSC] WebAssemblyGCStructure::finalizeUnconditionally should be called
- [JSC] ScopedArgumentsTable ScopeOffset buffer should allocate from fastMalloc