◆ WebKit WeeklyBeta

Constellation

JSC security specialist

500 commits (7mo)
10 security fixes
View all commits on GitHub ↗

Summary

Works almost exclusively in JavaScriptCore, with recent activity concentrated on the memory64 transition in WebAssembly — ArrayBuffer and `Wasm::Memory` sizing, `memory.init` overflow checks, BBQ/OMG pointer and trap handling — alongside JIT backend cleanup (removing 32-bit-only concepts, Air opcode work, `enableInt52` removal) and Intl/Iterator spec conformance. The security-flagged fixes are a small slice of overall output; the more informative signal is a recurring thread of index-width and bounds-check correctness, including propagating `uint64_t` indices through TypedArray bound checks and fixing `table.copy` identity checks that relied on index. Systematic-variant candidate: the 32-bit-to-64-bit widening of indices and offsets across Wasm memory/table paths and TypedArray access — any site where a wide index is truncated or bound-checked before widening is a plausible OOB, and this refactor touched many of them at once.

Components

JSC
86%
WTF
4%
JSC YARR
3%
WebCore
1%
Other
1%
WebKit
1%

Security Fix History

Hardening Commits

Recent Commits

1 / 34

← All Contributors