heimskr
JSC security specialist
Summary
heimskr works almost entirely inside JavaScriptCore, split between the tiered JIT (DFG fixup and strength reduction, FTL OSR exit, OMG/B3, YarrJIT) and non-security feature work — Explicit Resource Management, Joint Iteration, RegExp Buffer Boundaries, and a rewritten test262 runner. The security fixes are overwhelmingly optimizer-invariant failures, where a flag or piece of metadata stops holding once a transform runs: NodeMustGenerate cleared on overflow-checked ArithAdd/ArithSub, `usesSIMD()` unset when OMG inlines a SIMD callee into a non-SIMD root, DataFormatStorage unhandled during OSR-exit reboxing, a Yarr backtrack trampoline missing its additional-read-size adjustment; a smaller but distinct cluster covers stale structure and IC state in property access (absence conditions ignoring non-reified static tables, shadowed custom accessors on flattened dictionaries, a stale structure bit in SlowPutArrayStorage). Systematic-variant candidate: the "analysis result not propagated across an inlining or lowering boundary" shape, especially against the recently landed global inlining planner and priority-queue inliner, which widen the set of call sites where those propagation assumptions have to hold.
Components
Security Fix History
- 2026-09-04 [JSC] Validate RegExps in DFG strength reduction phase 2026-W35
- 2026-09-01 [JSC] YarrJIT non-BMP backtrack trampoline (L>F branch) does not add firstCharacterAdditionalReadSize to index, returns ·
- 2026-08-27 [JSC] WebAssembly try/catch result-type confusion omits optimized reference checks 2026-W34
- 2026-08-26 [JSC] Procedure::usesSIMD() not set when OMG inlines a SIMD callee into a non-SIMD root · CVE-2026-64780
- 2026-08-25 [JavaScriptCore] Absence PropertyCondition does not consult non-reified static property tables ·
- 2026-08-22 [JSC] NodeMustGenerate incorrectly cleared on CheckOverflow ArithAdd/ArithSub in DFGFixupPhase Inc/Dec handler
- 2026-08-18 [JSC] Add global priority queue inliner 2026-W33
- 2026-08-13 [JSC] FTL OSR exit: handle DataFormatStorage in reboxAccordingToFormat ·
- 2026-07-01 [libpas] bmalloc_try_allocate_zeroed_inline calls PAS_MAR_TRACK_ALLOCATION instead of PAS_MAR_TRACK_ALLOCATION_AND_ZERO ·
- 2026-06-30 [JSC] Stale structure bit in SlowPutArrayStorage ·
Hardening Commits
Recent Commits
- 2026-09-16 [JSC] Refine JSObject::crashDueToEmptyValueAtValidOffset data
- 2026-09-11 [JSC] Throwing an exception causes a CPA2 failure in LLInt slow paths
- 2026-09-09 [JSC] Stale IC when a custom accessor on a previously flattened dictionary is shadowed
- 2026-09-04 [JSC] Validate RegExps in DFG strength reduction phase 2026-W35
- 2026-09-02 [JSC] Enable global inlining planner
- 2026-09-01 [JSC] YarrJIT non-BMP backtrack trampoline (L>F branch) does not add firstCharacterAdditionalReadSize to index, returns ·
- 2026-08-27 [JSC] WebAssembly try/catch result-type confusion omits optimized reference checks 2026-W34
- 2026-08-26 [JSC] Procedure::usesSIMD() not set when OMG inlines a SIMD callee into a non-SIMD root · CVE-2026-64780
- 2026-08-25 [JavaScriptCore] Absence PropertyCondition does not consult non-reified static property tables ·
- 2026-08-22 [JSC] NodeMustGenerate incorrectly cleared on CheckOverflow ArithAdd/ArithSub in DFGFixupPhase Inc/Dec handler
- 2026-08-18 [JSC] Add global priority queue inliner 2026-W33
- 2026-08-13 [JSC] FTL OSR exit: handle DataFormatStorage in reboxAccordingToFormat ·
- 2026-08-05 [JSC] Rewrite test262 runner
- 2026-08-02 [JSC] Add support for Regular Expression Buffer Boundaries proposal
- 2026-07-29 [JSC] Assemble diagnostic data when getDirect returns an all-zero JSValue during llint_slow_path_get_by_id