TypeConfusion
33 commits
Type punning, downcast without check, JIT speculation letting a wrong shape through.
2026-W32 2026-08-08 – 14
- [JSC] FTL OSR exit: handle DataFormatStorage in reboxAccordingToFormat
- [JSC] SerializedScriptValue is not carrying memory64 flag
2026-W31 2026-08-01 – 07
2026-W30 2026-07-25 – 31
2026-W29 2026-07-18 – 24
2026-W28 2026-07-11 – 17
2026-W26 2026-06-27 – 07-03
- Type confusion in ReadableStream.cancel() via jsCast<JSPromise*>
- Guard against MessagePort confusion in the Network Process
- Type confusion via raw Exception cell returned to script from callPromisePairFunction when throwVMError bypasses sentinel check
- putPixelBuffer() and getPixelBuffer() should never be called for PDF and DisplayList ImageBufferBackends
- m_bufferMapCount via getMappedRange State Confusion Leads to GPU OOB
- WasmGC should reject reserved bits in br_on_cast/br_on_cast_fail flags byte
- [web-animations] accelerated animation with view progress timeline range and a scroll time yields a crash
- [WebCore] TransformStream type confusion when Array.prototype[Symbol.iterator] is overridden
- [JSC] Do not cache property absence on dictionaries
- [JSC] Stale structure bit in SlowPutArrayStorage
- [WebCore][bindings] Empty JSValue returned to script from callPromisePairFunction when argument conversion throws
- [WebGPU] Stale WeakPtr comparison in BindGroupLayout::errorValidatingBindGroupCompatibility allows incompatible auto/explicit layout pairing
2026-W24 2026-06-13 – 19
- [JSC] Take slow path in LiteralParser if original structure changes
- Type Confusion in RTCEncodedStreamProducer.cpp Results in OOB Read
- WebGL: GenerateMipmap after out of base level -max level texupload uses the wrong type
2026-W23 2026-06-06 – 12
- [JSC] ToBoolean/TypeOfIsUndefined/TypeOfIsFunction/TypeOf/CompareEq def value in DFGClobberize doesn't depend on node's origin.semantic
- [JSC] Promise.resolve should not folded to identity on Promise subclasses
- Type confusion in ReadableStream when cancel returns a fake Promise object
2026-W22 2026-05-30 – 06-05
2026-W21 2026-05-23 – 29
- [JSC] StringAt should respect arrayMode in CSE
- [JSC] Check initial object structure in tryEnsureAbsence in DFG
- [JSC] DFG object allocation sinking shouldn't insert a check when given a PutByVal node
- [JSC] Fix vector caching in TypedArray.prototype.forEach
- [JSC] Skip transitions with symbol names in LiteralParser