ast-hugger
JSC security specialist
Summary
Works almost entirely in JSC, split between parser/lexer throughput work (single-pass int token scanning, hot-path pruning, Parser/Lexer and InlineCacheHandler struct layout) and WebAssembly runtime internals, including JSPI stack switching and conservative-scan interaction. The security fixes cluster hard on the wasm side — a use-after-free in StreamingCompiler ticket handling, a UAF after growing a resizable buffer backing wasm memory, overlapping stack slots in BBQJIT tail-call shuffles, and missing traversal of expanded types in wasm GC structure dependencies — with a single DFG ArgumentsElimination scan-index bug as the outlier. Systematic-variant candidate: the JSPI evacuated-stack and conservative-root-scan paths, where the same author landed several correctness fixes (stack overflow handling, callee cleanup across multiple scans, `prepareForConservativeScan()` constraints) in close succession — the lifetime assumptions there are clearly still settling.
Components
Security Fix History
- 2026-06-30 [JSC] DFGArgumentsEliminationPhase removeViaKill should reset node scan index between InlineCallFrames ·
- 2026-06-16 Use-after-free of StreamingCompiler::m_ticket
- 2026-06-12 [JSC] BBQJIT tail call shuffle should detect overlapping stack slots ·
- 2026-06-03 [JSC] Add a test of WebAssembly IPInt stack check ·
- 2026-05-01 [JSC] Eagerly build AST for likely IIFEs
- 2026-04-29 [JSC] Use-after-free after growing a resizable buffer on a WebAssembly memory CVE-2026-20664
- 2026-04-17 [JSC] `WebAssemblyGCStructureTypeDependencies::process` should traverse expanded types
Hardening Commits
Recent Commits
- 2026-08-20 [JSC] Stop computing free variables twice when popping a function scope
- 2026-08-20 [JSC] Preallocate SourceProviderCache::m_map
- 2026-08-20 [JSC] Remove the obsolete optimization in Lexer::shift
- 2026-08-20 [JSC] Do not accumulate new token positions in parseMemberExpression for SyntaxChecker
- 2026-08-14 [JSC] Add a fast path to Parser::useVariable
- 2026-08-11 [JSC] Implement op_switch_string fast path in baseline JIT
- 2026-08-07 [JSC] Retire Lexer::lexExpectIdentifier()
- 2026-08-04 [JSC] Move two rarely-executed code paths out of the lexer and parser hot functions
- 2026-07-31 [JSC] Scan an int token in a single pass
- 2026-07-21 [JSC] Generate Data IC code as fall-through
- 2026-06-30 [JSC] DFGArgumentsEliminationPhase removeViaKill should reset node scan index between InlineCallFrames ·
- 2026-06-22 [JSC] Create a save point only if actually checking for "use strict"
- 2026-06-16 Use-after-free of StreamingCompiler::m_ticket
- 2026-06-12 Mark myself (ast-hugger) as a reviewer
- 2026-06-12 [JSC] BBQJIT tail call shuffle should detect overlapping stack slots ·