asworkjsc
JSC security specialist
Summary
Works almost entirely in JavaScriptCore, with the bulk of the work in the WebAssembly stack — IPInt interpreter bounds/metadata handling, BBQ constant folding, WasmGC decoding, streaming compilation, and the multimemory and relaxed SIMD feature flags — alongside scattered Yarr JIT, B3, DFG, and Temporal changes. The security fixes track the same surface they build: shipping multimemory support and then fixing an IPInt bounds-check underflow on zero-size memories, plus reserved-bit validation in `br_on_cast` flags and a streaming-compiler gap that accepted mixed legacy and spec-correct exception handling. Systematic-variant candidate: the wasm decoder's handling of reserved/undefined bits and validation paths that differ between streaming and one-shot compilation, where the same class of gap has already surfaced more than once.
Components
Security Fix History
- 2026-09-04 Pre-invalidate captured-variable WatchpointSets in generator and async function bodies ·
- 2026-09-01 Make B3 ccmp chain matcher use RAII ·
- 2026-09-01 IPInt br_on_cast/br_on_cast_fail must handle overlong LEB128 opcode ·
- 2026-07-01 Change IPInt m_pendingOffset to std::optional and add metadata offset overflow assertions ·
- 2026-07-01 WasmGC should reject reserved bits in br_on_cast/br_on_cast_fail flags byte ·
- 2026-07-01 Streaming compiler does not reject mixed legacy and spec-correct EH · CVE-2026-43745
- 2026-06-30 Add size limit to Yarr generated code ·
- 2026-06-30 YarrJIT negativeOffsetIndexedAddress discards adjusted base register ·
- 2026-06-02 Fix baseline write barrier handling in OpDelBy{Id,Val} ·
- 2026-05-26 Fix dominance analysis in B3CanonicalizePrePostIncrements ·
Hardening Commits
- 2026-09-01 Make B3 ccmp chain matcher use RAII ·
- 2026-07-01 Change IPInt m_pendingOffset to std::optional and add metadata offset overflow assertions ·
- 2026-07-01 WasmGC should reject reserved bits in br_on_cast/br_on_cast_fail flags byte ·
- 2026-06-30 Add size limit to Yarr generated code ·
- 2026-06-24 Check if JSArray::fastFlat exceeds maximum legal length
- 2026-03-24 Check for valid memory when parsing memory.init
- 2026-03-09 Make StringBuilder in regExpProtoFuncReplace report OOM
Recent Commits
- 2026-09-14 Try range in explicit resource management should include jump
- 2026-09-04 Pre-invalidate captured-variable WatchpointSets in generator and async function bodies ·
- 2026-09-01 Make B3 ccmp chain matcher use RAII ·
- 2026-09-01 IPInt br_on_cast/br_on_cast_fail must handle overlong LEB128 opcode ·
- 2026-08-25 Speed up lunisolar calendar month walk in JS Temporal
- 2026-08-04 Widen JS Temporal time zone cache in TimeZoneICUBridge.cpp
- 2026-07-23 Mark crash-on-overflow functions in WTF OverflowHandler.h as NODELETE
- 2026-07-22 Clean up JS Temporal getNamedTimeZoneEpochNanoseconds
- 2026-07-21 Enable wasm multimemory feature flag
- 2026-07-20 Enable wasm relaxed SIMD feature flag
- 2026-07-01 Change IPInt m_pendingOffset to std::optional and add metadata offset overflow assertions ·
- 2026-07-01 WasmGC should reject reserved bits in br_on_cast/br_on_cast_fail flags byte ·
- 2026-07-01 Streaming compiler does not reject mixed legacy and spec-correct EH · CVE-2026-43745
- 2026-06-30 Add size limit to Yarr generated code ·
- 2026-06-30 YarrJIT negativeOffsetIndexedAddress discards adjusted base register ·