hyjorc1
JSC security specialist
Summary
hyjorc1 works almost entirely inside JavaScriptCore, and the recent stream is dominated by Temporal/Intl calendar conformance — PrepareCalendarFields consolidation, non-ISO calendars through the ICU bridge, monthCode and Chinese leap-month handling, DST-gap resolution and out-of-range year guards — alongside WTF-level string fast paths (SIMD find16/find32 thresholds, SWAR copies in JSON.stringify). Their security fixes cluster somewhere else in the engine entirely: DFG/FTL sunk-allocation materialization and OSR exit, covering unwritten slots in operationPopulateObjectInOSR for PhantomNewArray-family nodes and GC safety when a sunk contiguous array is materialized. Systematic-variant candidate: the remaining sunk-allocation node types rematerialized on OSR exit, where the same unwritten-slot and GC-visibility invariants hold. The Temporal work is a second, independent surface — a large body of newly landed range and calendar-arithmetic code with its own bounds checks.
Components
Security Fix History
- 2026-06-11 [JSC] Fix incorrect handling of unwritten slots in operationPopulateObjectInOSR for PhantomNewArrayWithButterfly ·
- 2026-05-27 [JSC] ExpressionInfo::Encoder::adjustInstPC should take an index instead of a pointer
- 2026-05-26 [JSC] Fix GC safety for sunk contiguous array materialization in FTL 2026-W21
- 2026-05-21 [JSC] Remove unneeded m_tasks append in DeferredWorkTimer::cancelPendingWorkSafe 2026-W20
- 2026-03-07 [JSC] MapIterationEntryKey should have NodeResultJS, not NodeResultInt32 2026-W10
- 2026-01-30 [JSC][WASM][Debugger] Fix race condition causing debugger connection failures in JSC shell
- 2025-11-18 [JSC] Fix VMTraps race condition in fireTrap() for async events
Hardening Commits
- No hardening commits recorded
Recent Commits
- 2026-08-07 [JSC][Temporal] Implement ISODateToFields and CalendarMergeFields as the spec's own operations
- 2026-08-06 [JSC][Temporal] Align time zone identifier parsing with the spec's parse records
- 2026-08-05 [JSC][Temporal] Resolve DST gaps through GetPossibleEpochNanoseconds so the epoch range check is not skipped
- 2026-08-05 [JSC][Temporal] Fix constructor newTarget.prototype ordering and unify CreateTemporalX helpers
- 2026-08-04 [JSC][Temporal] Finish PrepareCalendarFields consolidation; fix monthCode TypeError regression
- 2026-08-04 [JSC][Temporal] Guard PlainDate construction against out-of-range years; consolidate CalendarResolveFields
- 2026-08-03 [JSC][Temporal][Intl.Era] Implement intl-era-monthcode
- 2026-07-30 Widen find16/find32 SIMD threshold; speed up ASCII case-conversion prefix copy
- 2026-07-30 [JSC] Extend Array.from()'s Set fast path to cover set.keys()/.values()
- 2026-07-28 [JSC] Add an 8-byte SWAR fast path to JSON.stringify's stringCopyUpconvert for short strings
- 2026-07-27 [JSC] Add an 8-byte SWAR fast path to JSON.stringify's stringCopySameType for short strings
- 2026-07-17 [JSC][Temporal] Fix PMD reference-year drop for Chinese leap months
- 2026-07-17 [JSC][Temporal] Extract GetTemporalCalendarIdentifierWithISODefault as a shared helper
- 2026-07-16 [JSC][Temporal] Consolidate InterpretTemporalDateTimeFields into one implementation
- 2026-07-15 [JSC][Temporal][Intl.Era] Add useIntlEraMonthcode option and narrow AvailableCalendars