TypeConfusion
58 commits
Type punning, downcast without check, JIT speculation letting a wrong shape through.
2026-W39 2026-09-26 – 10-02
2026-W38 2026-09-19 – 25
2026-W35 2026-08-29 – 09-04
- Pre-invalidate captured-variable WatchpointSets in generator and async function bodies
- [JSC] ObjectCreate folding should emit checks
- [JSC] Fix Object Allocation Sinking closure rule for allocations within inlined closure-call and varargs frames
- IPInt br_on_cast/br_on_cast_fail must handle overlong LEB128 opcode
2026-W34 2026-08-22 – 28
- OSR Availability Fails to Invalidate Local Recoveries Across LoadVarargs
- [Wasm] Argument and Result block types should always widen
- [Wasm] Delegate should widen types like End
- [Wasm] Unreachable end ops don't widen result types
- [JSC] WebAssembly try/catch result-type confusion omits optimized reference checks
- [JavaScriptCore] Absence PropertyCondition does not consult non-reified static property tables
- [JSC] Refresh AI state when folding GetScope to Identity
- [JSC] Fix BackwardsGraph for loops with multiple back-edge sources
- [JSC] DFG Uint32Array load should consider about Int32 speculation path
- [JSC] Do not clone patchpoints for Wasm calls within a try block
2026-W32 2026-08-08 – 14
- [JSC] FTL OSR exit: handle DataFormatStorage in reboxAccordingToFormat
- [JSC] SerializedScriptValue is not carrying memory64 flag
2026-W31 2026-08-01 – 07
2026-W30 2026-07-25 – 31
2026-W29 2026-07-18 – 24
2026-W28 2026-07-11 – 17
2026-W26 2026-06-27 – 07-03
- Type confusion in ReadableStream.cancel() via jsCast<JSPromise*>
- Guard against MessagePort confusion in the Network Process
- Type confusion via raw Exception cell returned to script from callPromisePairFunction when throwVMError bypasses sentinel check
- putPixelBuffer() and getPixelBuffer() should never be called for PDF and DisplayList ImageBufferBackends
- m_bufferMapCount via getMappedRange State Confusion Leads to GPU OOB
- WasmGC should reject reserved bits in br_on_cast/br_on_cast_fail flags byte
- [web-animations] accelerated animation with view progress timeline range and a scroll time yields a crash
- [WebCore] TransformStream type confusion when Array.prototype[Symbol.iterator] is overridden
- [JSC] Do not cache property absence on dictionaries
- [JSC] Stale structure bit in SlowPutArrayStorage
- [JSC] Disallow defining private names on WasmGC objects
- [WebCore][bindings] Empty JSValue returned to script from callPromisePairFunction when argument conversion throws
- [WebGPU] Stale WeakPtr comparison in BindGroupLayout::errorValidatingBindGroupCompatibility allows incompatible auto/explicit layout pairing
- [JSC] Spread operator doesn't account for cellButterflyOnlyAtomStringsStructure in DFG
2026-W24 2026-06-13 – 19
- [JSC] Take slow path in LiteralParser if original structure changes
- Type Confusion in RTCEncodedStreamProducer.cpp Results in OOB Read
- WebGL: GenerateMipmap after out of base level -max level texupload uses the wrong type
2026-W23 2026-06-06 – 12
- [JSC] ToBoolean/TypeOfIsUndefined/TypeOfIsFunction/TypeOf/CompareEq def value in DFGClobberize doesn't depend on node's origin.semantic
- [JSC] Promise.resolve should not folded to identity on Promise subclasses
- Type confusion in ReadableStream when cancel returns a fake Promise object
2026-W22 2026-05-30 – 06-05
2026-W21 2026-05-23 – 29
- [JSC] StringAt should respect arrayMode in CSE
- [JSC] Check initial object structure in tryEnsureAbsence in DFG
- [JSC] DFG object allocation sinking shouldn't insert a check when given a PutByVal node
- [JSC] Fix vector caching in TypedArray.prototype.forEach
- [JSC] Skip transitions with symbol names in LiteralParser
2026-W20 2026-05-16 – 22
2026-W19 2026-05-09 – 15
- [JSC] Inline allocation for `Promise.resolve()` of a non-thenable object
- [JSC] Cache `isDefinitelyNonThenable` result on Structure
- [JSC] Cache result of Symbol.prototype.toString
- [JSC] Optimize initial `then` call
- [JSC] Do not allocate promise reaction when it is initial `then` calls and one handler attachment
- [JSC] Extract fields of descriptor in Object.defineProperty in DFG / FTL