heimskr
JSC security specialist
Summary
Works almost entirely inside JavaScriptCore, splitting time between new TC39 proposal implementations (Explicit Resource Management, Joint Iteration, RegExp Buffer Boundaries), test infrastructure (test262 runner rewrite, run-regexp-tests paths), and a dense run of engine-correctness fixes. The security work concentrates in the DFG/FTL pipeline — a stale structure bit in SlowPutArrayStorage, a missing ensureStillAliveHere in compileArrayIndexOfOrArrayIncludes, a use-after-free from a stale Wasm memory pointer folded by DFGConstantFoldingPhase, and incorrect def() values in DFGClobberize — with adjacent finds in resizable-ArrayBuffer reentrancy (TypedArray.from mapFn callback), inline-cache locking in repatchGetBySlowPathCall, and a WaiterListManager data race. Systematic-variant candidate: the clobberize/abstract-interpreter mismatch class, where a node's declared effects diverge from what it actually reads or writes, has yielded several distinct bugs here, and the sweep surface is every DFG node with a hand-written clobberize/def entry — plus the freshly enabled proposal implementations, which have not yet accumulated the same fix history.
Components
Security Fix History
- 2026-07-01 [libpas] bmalloc_try_allocate_zeroed_inline calls PAS_MAR_TRACK_ALLOCATION instead of PAS_MAR_TRACK_ALLOCATION_AND_ZERO ·
- 2026-06-30 [JSC] Stale structure bit in SlowPutArrayStorage ·
- 2026-06-30 [JSC][FTL] compileArrayIndexOfOrArrayIncludes (UntypedUse + Array::Contiguous): ensureStillAliveHere(base) placed before ·
- 2026-06-30 [JSC] Missing codeBlock->m_lock in repatchGetBySlowPathCall ·
- 2026-06-30 [JSC] TypedArray.from() Out-of-Bounds Read via Resizable ArrayBuffer resize/transfer in mapFn callback. ·
- 2026-06-30 [JSC] Spread operator doesn't account for cellButterflyOnlyAtomStringsStructure in DFG ·
- 2026-06-29 [JSC] Use-after-free after Wasm memory grow via stale pointer folded by DFGConstantFoldingPhase ·
- 2026-06-16 [JSC] Track customSlotBase for CustomAccessorGetter/CustomAccessorSetter ·
- 2026-06-12 [JSC] ToBoolean/TypeOfIsUndefined/TypeOfIsFunction/TypeOf/CompareEq def value in DFGClobberize doesn't depend on node's ·
- 2026-06-02 [JSC] Data race in WaiterListManager::unregister 2026-W22
Hardening Commits
- No hardening commits recorded
Recent Commits
- 2026-08-05 [JSC] Rewrite test262 runner
- 2026-08-02 [JSC] Add support for Regular Expression Buffer Boundaries proposal
- 2026-07-29 [JSC] Assemble diagnostic data when getDirect returns an all-zero JSValue during llint_slow_path_get_by_id
- 2026-07-29 [JSC] Update test path in run-regexp-tests
- 2026-07-24 [JSC] Enable Explicit Resource Management by default
- 2026-07-24 [JSC] Implement Joint Iteration proposal
- 2026-07-01 [libpas] bmalloc_try_allocate_zeroed_inline calls PAS_MAR_TRACK_ALLOCATION instead of PAS_MAR_TRACK_ALLOCATION_AND_ZERO ·
- 2026-06-30 [JSC] Stale structure bit in SlowPutArrayStorage ·
- 2026-06-30 [JSC][FTL] compileArrayIndexOfOrArrayIncludes (UntypedUse + Array::Contiguous): ensureStillAliveHere(base) placed before ·
- 2026-06-30 [JSC] Missing codeBlock->m_lock in repatchGetBySlowPathCall ·
- 2026-06-30 [JSC] TypedArray.from() Out-of-Bounds Read via Resizable ArrayBuffer resize/transfer in mapFn callback. ·
- 2026-06-30 [JSC] Spread operator doesn't account for cellButterflyOnlyAtomStringsStructure in DFG ·
- 2026-06-29 [JSC] Use-after-free after Wasm memory grow via stale pointer folded by DFGConstantFoldingPhase ·
- 2026-06-16 [JSC] Track customSlotBase for CustomAccessorGetter/CustomAccessorSetter ·
- 2026-06-15 [JSC] Yarr JIT \B+unicode+surrogate produces corrupted JSString, crashes WebContent