sosukesuzuki

JSC security specialist

456 commits (11mo)

24 security fixes

10 hardening

Summary

Almost entirely JSC, split between YARR/RegExp semantics and the DFG/FTL OSR exit machinery, with only incidental WTF touches. The flagged security fixes sit in JIT lowering — folding `Shl` into `WasmAddress` index form over a locked value's `Tmp`, `DFGFixupPhase` clearing `NodeMustGenerate` on checked arith — while the larger RegExp stream is spec-conformance work that repeatedly brushes memory safety: `RegExp::deleteCode()` clobbering the pattern's atom, `RegExpTestInline` crashing when `deleteAllCode()` runs during a DFG/FTL compile, `sizeOfVarargs` truncating a strict arguments length to 32 bits, and array element clearing racing the concurrent marker. Systematic-variant candidate: RegExp object lifecycle under JIT inlining — code invalidation racing in-flight compilation, plus inlined fast paths that skip observable reads such as `lastIndex`.

Components

JSC

97%

WTF

Security Fix History

2026-09-13 [JSC] Extract `CheckInBounds` from `StringAt` and `StringCodePointAt` 2026-W37
2026-09-07 [JSC] Folding `Shl` into `WasmAddress` index form can use a locked value's `Tmp` 2026-W36
2026-09-05 [JSC] Inline `RegExp#test` for unicode patterns and patterns with a Yarr frame 2026-W36
2026-08-27 [JSC] `DFGFixupPhase` should not clear `NodeMustGenerate` on checked arith nodes 2026-W34
2026-06-11 [JSC] `Heap::clearConcurrentRetainedDataIfPossible()` should not run while concurrent marking is active 2026-W23
2026-06-09 [JSC][Temporal] Validate `month` and `eraYear` in Japanese "ce"/"bce" era fast path
2026-05-20 [JSC] Add new `DateNow` DFG node 2026-W20
2026-05-16 [JSC] Implement `String#match` in C++ 2026-W20
2026-05-15 [JSC] Inline allocation for `Promise.resolve()` of a non-thenable object 2026-W19
2026-05-15 [JSC] Cache `isDefinitelyNonThenable` result on Structure 2026-W19
2026-05-08 [JSC] Implement `String#split` in C++ 2026-W18
2026-05-07 [JSC] IPInt fast path for `memory.atomic.wait32`/`wait64` wraps the Memory64 effective address 2026-W18
2026-05-07 [JSC] IPInt slow path for `memory.atomic.notify` truncates the Memory64 pointer and offset to 32 bits 2026-W18
2026-04-30 [JSC] Walk star-export graph once when building a module namespace
2026-04-30 [JSC] Compare 8-bit strings a word at a time in DFG/FTL string equality
2026-04-29 [JSC] DFG iterator_next should dispatch fast modes by iterator type
2026-04-20 [JSC] Refine clobberize rule for `ArrayIsArray`
2026-04-10 [JSC] Add `ArrayLengthStore` IC for `JSArray` length assignment
2026-03-26 [JSC] TypedArray `[[Set]]` should check receiver before writing to typed array CVE-2026-84635
2026-03-25 [JSC] Handle `Error.isError` in DFG/FTL with `IsCellWithType` node
2026-03-17 [JSC] Implement `await using` syntax from Explicit Resource Management proposal
2026-03-10 [JSC] Implement `using` syntax from Explicit Resource Management proposal
2026-02-19 [YARR] Fix out-of-bounds table access in JIT case-insensitive backreference matching
2026-02-18 [YARR] Fix incorrect offset when reading pattern character for Unicode backreference in JIT CVE-2026-43740

1 / 3

Hardening Commits

Recent Commits

2026-09-18 [JSC] `RegExp#test` anchored first-character filter must not skip the `lastIndex` read
2026-09-18 [JSC] Remove `doneLocation` from `HandlerPropertyInlineCache`
2026-09-18 [YARR] `\k<name>` in a lookbehind matches empty when the group was opened last
2026-09-17 [JSC] Shrink the FTL code that enters the OSR exit thunk
2026-09-17 [JSC] `JSArray::setLength` should not count elements when the new length fits in the vector
2026-09-17 [JSC] Read `Error.stackTraceLimit` from the `Error` constructor when capturing a stack
2026-09-16 [JSC] Shrink the DFG code that enters the OSR exit thunk
2026-09-16 [JSC] Store DFG OSR exits as a byte stream
2026-09-16 [JSC] `sizeOfVarargs` truncates a strict arguments object's length to 32 bits
2026-09-15 [JSC] DFG `RegExpTest` asserts when the RegExp is also the argument
2026-09-15 [JSC] DFG folds a module variable to a stale value after an import cycle
2026-09-15 [JSC] `BigInt("-")` and `BigInt("0x ")` should throw a `SyntaxError`
2026-09-14 [JSC] `by-val` accesses should not loop on `BadStringType` OSR exits
2026-09-14 [JSC] Non-global `RegExp#replace` with an empty string should return a substring
2026-09-13 [JSC] Extract `CheckInBounds` from `StringAt` and `StringCodePointAt` 2026-W37
2026-09-13 [JSC] Add Toom-3 multiplication to `JSBigInt`
2026-09-10 [JSC] `RegExp::deleteCode()` should not clear the pattern's atom
2026-09-10 [JSC] Array element clearing goes through libc memset and races the concurrent marker
2026-09-10 [YARR] Share built-in character classes between all `YarrPattern`s
2026-09-08 [JSC] `RegExpTestInline` crashes when `deleteAllCode()` runs during a DFG/FTL compilation
2026-09-08 [YARR] `\-` following a class set operand in a `/v` class throws a SyntaxError
2026-09-08 [JSC] `RegExp.escape` should not narrow supplementary code points to 16 bits
2026-09-07 [JSC] Folding `Shl` into `WasmAddress` index form can use a locked value's `Tmp` 2026-W36
2026-09-07 [JSC] Fill the result array of `Object.values` directly instead of via `MarkedArgumentBuffer`
2026-09-07 [JSC] Keep doubles outside the int32 range on the `ToInt32` fast path on x86_64
2026-09-06 [JSC] `RegExp#test` minimum-length filter must not skip the `lastIndex` read
2026-09-05 [JSC] Inline `RegExp#test` for unicode patterns and patterns with a Yarr frame 2026-W36
2026-09-05 [YARR] Keep the terms of lookbehinds in match order in YarrPattern
2026-09-04 [JSC] Add Karatsuba multiplication to `JSBigInt`
2026-09-04 [YARR] Match lookbehinds in the interpreter from a copy of the disjunction in match order
2026-09-04 [JSC] Vectorize `Array#indexOf` and `Array#includes` on long Int32 and Double arrays
2026-09-04 [JSC] `RegExp#test` should fast-fail on an input shorter than the pattern's minimum size
2026-09-03 [JSC] Deleting a property of a dictionary prototype in place does not invalidate the megamorphic store cache
2026-09-02 [JSC] Baseline JIT should not construct `GCOwnedDataScope` on the compiler thread
2026-09-02 [JSC] Store DFG OSR entry expected values as a byte stream
2026-09-01 [JSC] Store FTL OSR exit `ValueRep`s as a byte stream and shrink `FTL::OSRExit`
2026-09-01 [JSC] One accessor on a prototype disables the megamorphic store cache
2026-09-01 [JSC] `Temporal.ZonedDateTime.prototype.round` resolves the rounded wall-clock time with a minute-rounded offset
2026-09-01 [YARR] A character following a class set operand in a `/v` class adds `U+0000`
2026-09-01 [JSC] `WebAssembly.Exception` rejects null options and accepts non-object options
2026-08-30 [JSC] Reuse `FunctionExecutables` instantiated for module function declarations
2026-08-29 [JSC] DFG `StringReplace` constant folding steps into a surrogate pair after an empty match for unicode RegExps
2026-08-27 [JSC] Store the DFG `VariableEventStream` as a byte stream
2026-08-27 [JSC] `DFGFixupPhase` should not clear `NodeMustGenerate` on checked arith nodes 2026-W34
2026-08-27 [JSC] Store `OSRExitDescriptor` exit values as a compact byte stream
2026-08-26 [JSC] LINK `op_instanceof` metadata in `CodeBlock::finishCreation`
2026-08-25 [JSC] Deeply nested destructuring pattern crashes bytecode generation
2026-08-25 [YARR] Compile lookbehinds containing lookaheads in JIT
2026-08-25 [JSC] Use `objectCloneFast` for object rest destructuring in `@copyDataProperties`
2026-08-25 [YARR] Compile lookbehinds containing quantified groups in the JIT
2026-08-22 [JSC] `SymbolTableEntry` should not allocate a `WatchpointSet` until somebody watches the variable
2026-08-22 [JSC] Use `objectCloneFast` for the first source in `Object.assign`'s batching path
2026-08-21 [JSC] `WTF::weekDay` overflows for days near `INT32_MAX` and is duplicated in Temporal
2026-08-21 [YARR] Compile lookbehinds containing backreferences in the JIT
2026-08-21 [YARR] `tryConsumeBackReference` should restore input position when a surrogate pair read fails in interpreter
2026-08-20 [JSC] Use `FixedVector` for `RegExp::m_ovector` and `RareData::m_captureGroupNames`
2026-08-20 [JSC] Remove `CallLinkInfo::m_slowPathCount`
2026-08-19 [JSC] Inline `Map#forEach` / `Set#forEach` iteration in DFG and FTL
2026-08-19 [JSC] Bytecode cache should generate `CodeForConstruct` for class constructors
2026-08-18 [JSC] Remove `UnlinkedCodeBlock::m_jumpTargets`
2026-08-18 [JSC] Move the fields only global code uses out of `UnlinkedCodeBlock`
2026-08-17 [JSC] Do not allocate `UnlinkedFunctionExecutable::RareData` for generator/async bodies whose wrapper has no parameters
2026-08-17 [JSC] Move `PropertyInlineCache`'s buffered-structures set to `RepatchingPropertyInlineCache`
2026-08-15 [JSC] Move repatching-only fields out of `HandlerPropertyInlineCache`
2026-08-15 [JSC] Do not eagerly create `Set.prototype`, `WeakRef`, and `FinalizationRegistry` in `JSGlobalObject::init()`
2026-08-15 [YARR] Compile lookbehinds in unicode patterns in the JIT
2026-08-13 [YARR] Collect Boyer-Moore info through parenthetical assertions
2026-08-12 [YARR] Compile lookbehinds in the JIT
2026-08-12 [YARR] Unicode property escapes ignore case-insensitivity in u and v modes
2026-08-12 [JSC] `Array#join` on Int32 arrays should use `JSOnlyStringsAndInt32sJoiner` for any separator
2026-08-12 [JSC] Move `m_parentScopeTDZVariables` into `UnlinkedFunctionExecutable` itself
2026-08-12 [JSC] `SourceProviderCacheItem::create` over-allocates the trailing `PackedPtr` array
2026-08-11 [Wasm] `call_indirect` in unreachable code should validate the table element type and the signature kind
2026-08-11 [JSC] `MicrotaskQueue::performMicrotaskCheckpoint` should not call `drain()` on an empty queue
2026-08-11 [YARR] JIT string-list alternative with a non-BMP character matches after only its leading characters
2026-08-11 [JSC] Shrink `StructureRareData` back to 96 bytes
2026-08-10 [YARR] Read raw code units for surrogate-free BMP character classes in unicode mode
2026-08-10 [YARR] Interpreter should skip every once-through alternative after advancing the start position
2026-08-09 [YARR] `\P{...}` on the right side of a v-mode `&&` or `--` becomes a union
2026-08-07 [JSC] `JSC_JIT_CAGE_PROBE{,_IMPL}` fallback macros in `JITOperationValidation.h` do not compile
2026-08-07 [JSC] `String#split` should not atomize the results of a non-atom subject
2026-08-06 [JSC] RegExp trim fast path in `String#replace` is skipped once the caller tiers up to DFG/FTL
2026-08-06 [JSC] Use counting sort for `Array#sort`
2026-08-06 [JSC] `JSON.stringify` fast path should accept final objects with non `Object` prototypes
2026-08-06 [JSC] `Array#sort` without a comparator is not stable
2026-08-05 [JSC] `String#localeCompare` collator cache goes stale across language changes
2026-08-04 [JSC] Cache the collator for `String#localeCompare` with a string locale
2026-08-04 [JSC] `AbstractInterpreter::forAllValues` should handle tuple nodes
2026-08-04 [YARR] Let `\A` and `\z` use the anchoring optimizations of non-multiline `^` and `$`
2026-08-04 [JSC] `Function#bind` strength reduction in DFG should accept method structures
2026-08-04 [JSC] Follow-up cleanups after ARMv7 JIT removal
2026-08-04 [Wasm] `JSWebAssemblyInstance::updateCachedMemories()` crashes on a partially-linked instance
2026-08-03 [JSC] Inline `String#substring` in DFG/FTL
2026-08-03 [JSC] LLInt prologue should zero the new frame 16 bytes per iteration
2026-08-03 [JSC] Object-literal shorthand in an arrow function should not force the enclosing function to capture arguments
2026-08-03 [YARR] Do not filter the contents of a lookbehind in `optimizeBOL`
2026-08-02 [YARR] v-mode class set operations produce stale character widths
2026-08-02 [YARR] Stop the chunked v-mode class set operation loop as soon as it can produce nothing more
2026-08-01 [JSC] `Array.from(set.keys()/.values())` fast path ignores `Symbol.iterator` overrides
2026-07-31 [YARR] Start matching end-anchored fixed-size regexps at the only possible position
2026-07-31 [JSC] `EnumeratorNextUpdateIndexAndMode` should require the original array structure before using `InBoundsSaneChain`
2026-07-31 [JSC] `hostResolveImportedModule` should respect the module request's import attribute type
2026-07-30 [YARR] Do not filter the contents of a negative lookahead in `optimizeBOL`
2026-07-30 [JSC] Inline hot part of `op_enter` in LLInt
2026-07-30 [JSC] Use `defaultToPrimitiveFastAndNonObservable` for `JSObject::toString`
2026-07-30 [JSC] offlineasm never emits ARM64 register-offset addressing for BaseIndex operands
2026-07-30 [YARR] Fix non-BMP advance latch and simplify `tryReadUnicodeCharImpl`
2026-07-28 [JSC] Add missing `U_FAILURE(status)` for `actualLunisolarMonthLength`
2026-07-28 [JSC] `Iterator.zip` should use null-prototype objects for `GetOptionsObject` and the synthetic underlying iterator
2026-07-28 [JSC] Allocate DFG `BasicBlock::intersectionOfPastValuesAtHead` only for OSR entry targets
2026-07-26 [JSC] `JSModuleRecord` should not retain the parser's `VariableEnvironments`
2026-07-26 [YARR] `tryReadUnicodeChar` should read the first code unit before testing whether a second one is needed
2026-07-24 [JSC] Remove `AbstractModuleRecord::m_dependencies`
2026-07-24 [YARR] Enable Boyer-Moore lookahead optimization for Unicode patterns
2026-07-24 [JSC] Add OOB mode to `StringCharCodeAt` node in DFG/FTL
2026-07-23 [YARR] `tryReadUnicodeChar` should take the BMP fast path for any non-surrogate character
2026-07-22 [YARR] `InputStream::reread()` should check the code unit before a trail surrogate, not after
2026-07-21 [JSC] `Symbol.keyFor` should reuse the symbol's cached description string
2026-07-21 [JSC] Inline `ArrayBuffer.isView` in DFG/FTL by extending `IsCellWithType` to a JSType range
2026-07-21 [JSC] Avoid zero-filling and `gcSafeMemcpy` in `tryCreateObjectViaCloning`
2026-07-20 [JSC] Wire ARM64 min / max specialized thunks into `thunkGeneratorForIntrinsic`
2026-07-20 [JSC] `JSON.parse` should create 8-bit strings for Latin1 values in a 16-bit input
2026-07-20 [JSC] Use `vectorLengthHint` in `ArrayAllocationProfile` for `NewArrayWithSize` node
2026-07-18 [JSC] DFG should use the `ArrayIndexOf` / `ArrayIncludes` intrinsic for RegExp matches arrays
2026-07-18 [JSC] `Array#indexOf` / `includes` should not take the slow path for rope elements with mismatched length
2026-07-17 [JSC] Skip stress tests using `numberOfDFGCompiles` when JIT is unavailable
2026-07-17 [JSC] Handle `DataView` BigInt64 accessors in DFG / FTL
2026-07-17 [YARR] JIT backtracking of greedy variable-width character classes in unicode mode is `O(count)` per step
2026-07-17 [JSC] `AsyncFromSyncIterator` should not close the sync iterator for a rejected value when done is true
2026-07-16 [JSC] Use the generic path in `jsSpliceSubstringsWithSeparator(s)` for short two-range results
2026-07-15 [JSC] `Temporal.Duration` rounding divides by zero when a time zone transition skips an entire day
2026-07-15 [JSC] DFG strength reduction folds a compiler-thread RegExp execution failure into a definite no-match
2026-07-15 [JSC] Use `IntlCache` for Temporal pattern generation in `Intl.DateTimeFormat`
2026-07-14 [JSC] LLInt should record `IterationMode::Generic` in `op_iterator_next` and `op_async_iterator_next`
2026-07-14 [JSC] Do not emit unreachable implicit return for arrow function expression bodies
2026-07-14 [JSC] Skip redundant `resolve()` in `HostLoadImportedModule` for repeat dynamic imports
2026-07-14 [JSC] Support cross-realm Array fast path in `forEachInIterable`
2026-07-14 [JSC] `Integrity::isSanePointer()` should check alignment for typed pointers
2026-07-14 [JSC] `Strong<T>` should be pointer-sized
2026-07-13 [JSC] AsyncFromSyncIterator does not close correctly when the sync iterator yields a rejected value promise
2026-07-10 [JSC] Use a polymorphic cache for microtask calls
2026-07-09 [JSC] Add `TokNumberInt32` token type to `LiteralParser` to remove number conversion overhead
2026-07-09 [JSC] `Array#join` should write rope elements directly into the result buffer
2026-07-09 [JSC] Yarr should collect BM info for fixed-count terms
2026-07-08 [JSC] Host time zone changes are never observed on ports without time zone change notifications
2026-07-08 [JSC] Speculate on `String#concat` arguments based on profiling
2026-07-08 [JSC] Parse the replacement template only once in `String#replace` with a global RegExp and `'$'` substitutions
2026-07-07 [JSC] Add fast path for `Array#concat` with multiple arguments
2026-07-06 [JSC] Remove DFG TryGetById node
2026-07-06 [JSC] Convert `HasOwnProperty` on the current for-in property name to `EnumeratorHasOwnProperty`
2026-07-05 [JSC] `TypedArray.from()` spuriously throws when `mapFn` detaches or shrinks
2026-07-04 [JSC] Improve exception unwinding performance
2026-07-04 [Wasm] Don't move a failed streaming Wasm plan back to Compiled
2026-07-03 [JSC] Prove resolved values non-thenable for `NewResolvedPromise` in DFG constant folding
2026-07-03 [JSC] Skip Latin-1 single-character atomization in `s.split('')`
2026-07-02 [JSC] Some DFG intrinsics should bail out when the callee comes from another realm
2026-07-02 [WTF] `Int128` should fall back to `Int128Impl` when the standard library does not support `__int128_t`
2026-07-02 [YARR] EOL string list optimization produces incorrect matches with multiline flag
2026-07-02 [JSC] Use direct 3-character append for `"%XY"` escapes in `encode()`
2026-07-01 [JSC] Handle `String#trim`, `String#trimStart` and `String#trimEnd` in DFG / FTL
2026-06-30 [JSC] Support space argument in `FastStringifier`
2026-06-30 [JSC] Add fast path for `RegExp#flags` getter
2026-06-29 [JSC] `Array.from(arguments)` fast path should bail out when length exceeds `MAX_STORAGE_VECTOR_LENGTH`
2026-06-29 [JSC] Add missing exit-profile bails to some DFG nodes
2026-06-28 [JSC] Cache named-capture "groups" Structure on RegExp
2026-06-27 [JSC] Use `InstanceOf` DFG node for `Object#isPrototypeOf`
2026-06-27 [JSC] Enable RegExp atom fast path for unicode patterns
2026-06-26 [JSC] Emit expression info before `[Symbol.iterator]` get and spread
2026-06-26 [YARR] JIT backreference with non-BMP character skips next match start position
2026-06-25 [JSC] `Array#flat` fast path drops prototype-backed holes in nested arrays
2026-06-25 [JSC] Inline `NumericStrings` int cache lookup in DFG and FTL `ToString(Int32)`
2026-06-25 [JSC] Create a save point in `parseAssignmentExpression` only when it may be consumed
2026-06-24 [JSC] Replace fixup-inserted RegExp primordial `TryGetById` chains with a single `CheckStructure`
2026-06-24 [JSC] `Object.freeze`/`seal`/`preventExtensions` should not allocate `ArrayStorage` for `NonArray` objects
2026-06-23 [JSC] `IteratorClose` in `forEachInIterable` should use the Map/Set's own realm's iterator structure
2026-06-23 [JSC] `RegExp#@@split` should not crash on huge flags string
2026-06-23 [JSC] Avoid intermediate `StringImpl` allocation when feeding `StringBuilder` into `makeString`
2026-06-21 [JSC] Implement `%RegExpStringIteratorPrototype%.next` in C++
2026-06-21 [JSC] `Intl.PluralRules` should reflect `compactDisplay` in skeleton and `resolvedOptions`
2026-06-21 [Wasm] `intoCharCodeArray` copies 8-bit strings one character at a time
2026-06-20 [JSC] `Array.from(map.keys())` fast path ignores `Symbol.iterator` overrides
2026-06-19 [Wasm] BBQ `ControlData::m_tryTableTargets` should not have inline capacity
2026-06-19 [JSC][Temporal] `toLocaleString` should reuse the per-globalObject default `IntlDateTimeFormat` when locales/options are
2026-06-18 [JSC][Temporal] Check `ucal_add` failure in `calendarDateFromFields` and remove dead `combineISODateAndTimeRecord`
2026-06-18 [JSC] Add int32 fast path to `parseInt` for short decimal strings
2026-06-18 [JSC] Map/Set `set` + `delete` churn always expands then immediately shrinks
2026-06-16 [JSC] Pack ArrayBuffer's boolean fields to remove padding
2026-06-16 [JSC] for-of with closure-captured const binding never reaches DFG/FTL
2026-06-15 [JSC] Store `usedRegisters` only on `RepatchingPropertyInlineCache`
2026-06-13 [JSC] Add new DFG node for `StringIteratorPrototype.next`
2026-06-13 [JSC] Add `emitBytecodeInConditionContext` for nullish coalescing
2026-06-13 [JSC] `InlineCacheHandler` layout static_assert fails on Windows ARM64
2026-06-13 [JSC] DFG `RegExpSearch` constant folding drops `TypeError` for non-writable lastIndex
2026-06-13 [JSC] `String#replace`, `String#replaceAll` and `String#split` RegExp paths miss observable side effects
2026-06-11 [JSC] `GatherAvailableAncestors` and `AsyncModuleExecutionRejected` can overflow the stack on deep async module graphs
2026-06-11 [JSC] `Heap::clearConcurrentRetainedDataIfPossible()` should not run while concurrent marking is active 2026-W23
2026-06-11 [JSC] Deferred module namespace's `"then"` leaks into `Object.keys`
2026-06-10 [JSC] Set class field function names at parse time instead of via `SetFunctionName`
2026-06-10 [JSC][Wasm] IPInt memory.atomic.notify/wait and memory.grow mishandle dirty upper bits of i32 operands
2026-06-09 [JSC][Temporal] Validate `month` and `eraYear` in Japanese "ce"/"bce" era fast path
2026-06-09 [JSC] Remove redundant eager length definition in `JSPromiseConstructor`
2026-06-09 [JSC] Map/Set iteration fast paths should perform `IteratorClose` when the callback throws
2026-06-09 [JSC] `isDefinitelyNonThenable` Structure cache can go stale when the prototype belongs to another realm
2026-06-09 [JSC] `String#split` RegExp fast path misses side effects from `ToString(this)` and `ToUint32(limit)`
2026-06-06 [JSC][Temporal] `Intl.DateTimeFormat` Temporal formatters lose requested era width
2026-06-06 [JSC] `FreeList::forEach` interval assert should be bounded by `MarkedBlock::blockSize`
2026-06-06 [JSC] `Intl.DateTimeFormat` Temporal pattern generation should pass the calendar to ICU in BCP47 form
2026-06-06 [YARR] String list fast path drops a non-final empty alternative
2026-06-05 [JSC][Temporal] `PlainDate` add/subtract with a huge day count fails a day-range assertion
2026-06-05 [JSC] `ISO8601::parseDate` reads past the end of the buffer for short invalid strings
2026-06-04 [Wasm] `Table` constructor should fill funcref tables when the default value is a wrapper function
2026-06-04 [JSC] Promise jobs must not run with the realm of a cross-realm settle site
2026-06-03 [JSC] Use in-place JSBigInt for BigInt increment and decrement
2026-06-03 [YARR] `putRange()` misses Unicode canonical equivalents U+017F and U+212A for ASCII ranges
2026-06-02 [JSC] `GetByStatus::computeFor` should not constant-fold prototype loads when the head structure is a dictionary
2026-06-02 [JSC] Fix undefined behavior in double-to-int conversions
2026-06-02 [JSC] `matchAll` fast path should not skip `SpeciesConstructor` when RegExp species watchpoint is invalidated
2026-06-01 [JSC] Map/Set iterator fast path in `forEachInIteratorProtocol` should perform IteratorClose when the callback throws
2026-06-01 [JSC] Reject dictionary structures in `tryEnsureAbsence` in DFG
2026-06-01 [JSC] Add String fast iteration
2026-06-01 [JSC] DFG `NewTypedArrayWithSize` should zero-fill the storage 8 bytes at a time
2026-06-01 [JSC] Implement `String#search` in C++
2026-05-31 [JSC] Missing exception check in `forEachInIteratorProtocol` Set iterator fast path
2026-05-31 [JSC] Array rematerialization should preserve double Array holes when having a bad time
2026-05-30 [JSC] Inline-allocate cells for `NewWeakMap` and `NewWeakSet`
2026-05-30 [JSC] `Array.prototype.join` skips prototype element added during element toString
2026-05-29 [JSC] Cache per-unit number formatters in `Intl.DurationFormat`
2026-05-28 [JSC] Add NewWeakMap and NewWeakSet DFG nodes
2026-05-28 [JSC] Use `WTF::reverseFindDouble` for `Array#lastIndexOf`
2026-05-27 [JSC] Add a `gcSafeMemcpy` fast path for cloning large Maps and Sets
2026-05-27 [JSC] Add a root-locale fast path to `toLocaleLowerCase` and `toLocaleUpperCase`
2026-05-27 [Wasm] Add missing exception check after rope resolution
2026-05-27 [JSC] Cache language tag canonicalization results in `IntlCache`
2026-05-24 Unreviewed, Fix malformed `//@` directives in `JSTests` that were silently ignored
2026-05-22 [JSC] Add DFG node for `String.fromCodePoint`
2026-05-21 [JSC] Merge `ModuleRegistryEntry` error fields into a single field
2026-05-20 [JSC] Add new `DateNow` DFG node 2026-W20
2026-05-20 [JSC] Skip intermediate promise allocation for non-thenable elements in Promise combinators
2026-05-20 [Win] `OSAllocator::tryProtect` fails when memory spans multiple reserved regions
2026-05-19 [Wasm] Add PGlite (PostgreSQL wasm) stress test
2026-05-18 [JSC] Inline `String#startsWith` / `String#endsWith` with constant search string in DFG/FTL
2026-05-18 [JSC] Compare 8-bit strings a word at a time in `Array#indexOf` / `Array#includes`
2026-05-17 [JSC] Implement dynamic `import.defer()` semantics
2026-05-17 [JSC] Use `truncateDoubleToInt32`/`64()` in more round-trip double-to-int checks
2026-05-16 [JSC] Implement `String#match` in C++ 2026-W20
2026-05-16 [JSC] Avoid per-element `JSPromiseCombinatorsContext` allocation in Promise combinators
2026-05-15 [JSC] Inline allocation for `Promise.resolve()` of a non-thenable object 2026-W19
2026-05-15 [JSC] Cache `isDefinitelyNonThenable` result on Structure 2026-W19
2026-05-15 [JSC] Avoid creating both first resolving functions when only one is needed in `Promise.all` / `Promise.any`
2026-05-14 [JSC] Skip redundant `ModuleGraphLoadingError` reactions for already-loaded modules in `InnerModuleLoading`
2026-05-13 [JSC] Implement static `import defer` semantics
2026-05-13 [JSC] Avoid allocating `JSSlimPromiseReaction` for the single-await case
2026-05-12 [JSC] Guard `InnerModuleLoading` against unbounded mutual recursion
2026-05-12 [JSC] Mark obvious slow paths as `rarely()` instead of `unsure()` in `FTLLowerDFGToB3`
2026-05-10 [YARR] `containsCapturingTerms` should guard against stack overflow
2026-05-10 [JSC] Optimize FTL `Array#indexOf` / `Array#includes` string fast loop
2026-05-09 [libpas] `large_utility_aligned_allocator` unconditionally calls give_back on allocation failure
2026-05-09 [JSC] Remove `ALWAYS_INLINE` from `replaceUsingRegExpSearch`
2026-05-09 [JSC] Inline 16-bit string equality in DFG/FTL
2026-05-08 [libpas] `fast_large_free_heap` has inverted max-heap invariant checks
2026-05-08 [JSC] Implement `String#split` in C++ 2026-W18
2026-05-07 [JSC] Wasm Memory64 atomic ops truncate the immediate offset to 32 bits in BBQ and OMG
2026-05-07 [JSC] IPInt fast path for `memory.atomic.wait32`/`wait64` wraps the Memory64 effective address 2026-W18
2026-05-07 [JSC] IPInt slow path for `memory.atomic.notify` truncates the Memory64 pointer and offset to 32 bits 2026-W18
2026-05-07 [libpas] Fix race in `pas_bitfit_directory_take_last_empty`
2026-05-07 [libpas] `pas_scavenger_try_install_foreign_work_callback` leaks `foreign_work.lock` when descriptor table is full
2026-05-07 [YARR] Encode Unicode property tables as `constexpr` data instead of inline construction code
2026-05-07 [libpas] Fix `pas_all_heaps` standalone build
2026-05-04 [JSC] Gate `Array#concat` fast path on indexing-type merge compatibility
2026-05-04 [JSC] Call `ensureStillAliveHere` after `vmCall` in FTL `ArrayIndexOf`/`Includes`
2026-05-04 [JSC] Make `GatherAvailableAncestors` O(N) instead of O(N^2)
2026-05-04 [JSC] DFG should give up `ArraySlice` intrinsic after BadType OSR exit
2026-05-04 [JSC] Unroll zero-fill for `NewButterflyWithSize` with small constant length
2026-05-01 [JSC] Unroll zero-fill for `NewTypedArray` with small constant length
2026-04-30 [JSC] Add `emitBytecodeInConditionContext` for comma expression
2026-04-30 [JSC] Walk star-export graph once when building a module namespace
2026-04-30 [JSC] Compare 8-bit strings a word at a time in DFG/FTL string equality
2026-04-29 [JSC] DFG iterator_next should dispatch fast modes by iterator type
2026-04-29 [JSC] DFG `iterator_open` / `iterator_next` leave dangling failedBlock when a fast-mode watchpoint is invalidated
2026-04-26 [JSC] Avoid per-edge ModuleLoaderPayload allocation in graph loading
2026-04-26 [JSC] OMG should only emit WasmBoundsCheck overflow guard for Int64 pointers
2026-04-26 [JSC] Lazily resolve default calendar / numberingSystem in Intl constructors
2026-04-25 [JSC] Produce flat string from `padStart` / `padEnd` for short results
2026-04-25 [JSC] Add `emitBytecodeInConditionContext` for optional chaining
2026-04-25 [JSC] Refine clobberize rule for ObjectCreate
2026-04-25 [YARR] Reject dangling hyphen in class set under `/v` flag
2026-04-22 [JSC][Win] Add missing `SYSV_ABI` to `pinballHandlerFinishReject`
2026-04-22 [JSC] Lower `BitAnd(SShr(x, lsb), mask)` to `ubfx` for ARM64
2026-04-21 [YARR] Forward references are no longer JIT-compiled
2026-04-20 [JSC] Refine clobberize rule for `ArrayIsArray`
2026-04-18 [JSC] Avoid rope resolution for single-char `startsWith` / `endsWith`
2026-04-18 [JSC] Fix `Object.defineProperties` Proxy trap ordering
2026-04-17 [JSC] Fix null-env deref in CyclicModuleRecord::initializeEnvironment for WebAssembly modules
2026-04-17 [JSC] Cache `JSString` cells for short `JSON.parse` string values
2026-04-15 [JSC] Rewriting module loader follow-ups
2026-04-14 [JSC] Support `DoubleShape` in `ArrayLengthStore` IC
2026-04-13 [JSC] Add Int32 array fast path to `FastStringifier` for `JSON.stringify`
2026-04-13 [JSC] DFG should keep scope OSR-available for ModuleVar resolve_scope
2026-04-12 [JSC] Short-circuit assignment should not overwrite read-only locals
2026-04-10 [JSC] Add `ArrayLengthStore` IC for `JSArray` length assignment
2026-04-10 [YARR] `quantifyAtom` should handle `nullopt` from `copyTerm` on stack exhaustion
2026-04-10 [JSC] RegExp exec/test should reload internal RegExp after ToLength(lastIndex)
2026-04-08 [JSC] `import { "*" as x }` should not be treated as a namespace import
2026-04-08 [JSC] Refine clobberize rules for `CheckPrivateBrand` and `SetPrivateBrand`
2026-04-07 [YARR] Clear captures when backtracking out of ParenContext FixedCount and negative lookahead in JIT
2026-04-07 [JSC] `isWithinPowerOfTwo` is unsound for BitAnd with negative mask in DFG BackwardsPropagation
2026-04-07 [YARR] Reset `firstCharacterAdditionalReadSize` at `BodyAlternativeNext` reentry
2026-04-05 [JSC] Propagate InstanceFieldEvalContext through arrows and nested scopes
2026-04-03 [JSC] Use `tryFindOneChar` for dynamic one-char search string in DFG/FTL `String#indexOf` call
2026-04-03 [JSC] Remove redundant mov in await/yield bytecode generation
2026-04-02 [YARR] Fixed-count mixed-width character class should restore index on backtrack
2026-03-31 [YARR] Fix infinite loop in nested FixedCount ParenContext backtrack
2026-03-29 [JSC] Fix O(n^2) list building in offlineasm
2026-03-28 [JSC] Skip redundant RegExp syntax check when reparsing a function
2026-03-28 [JSC] Fix null butterfly dereference in JSValue::dumpInContextAssumingStructure
2026-03-27 [JSC] DFG AI should set SpecStringResolved for StringAt
2026-03-26 [JSC] Remove dead `thisRegister` mov in `emitCallImpl` / `emitConstructImpl` spread paths
2026-03-26 [YARR] Greedy/non-greedy non-BMP character class should not advance index past end-of-input
2026-03-26 [JSC] TypedArray `[[Set]]` should check receiver before writing to typed array CVE-2026-84635
2026-03-25 [JSC] Add missing NodeMustGenerate to RegExpExecNonGlobalOrSticky and DataViewGetByteLength
2026-03-25 [JSC] `String#repeat` should not resolve rope when building a rope result
2026-03-25 [JSC] Skip redundant mov in x == null / x != null bytecode
2026-03-25 [JSC] Handle `Error.isError` in DFG/FTL with `IsCellWithType` node
2026-03-24 [JSC] Fix completion value for bare/labeled/nested break and continue
2026-03-24 [JSC] Fix DFG crash when function with using declaration ends with return
2026-03-20 [JSC] for-using statement should not dispose on continue
2026-03-19 [JSC] Fix stack overflow in AsyncDisposableStack.prototype.disposeAsync
2026-03-19 [JSC] Use csel/fcsel for Wasm select in BBQ
2026-03-19 [JSC] Fix SIGSEGV in `Temporal.PlainDate.from` with out-of-range month and `overflow: "reject"`
2026-03-18 [JSC] Fix spec conformance bugs in Explicit Resource Management builtins
2026-03-18 [JSC] Nested using blocks lose outer disposals
2026-03-17 Unreviewed, update test262 config
2026-03-17 [JSC] Implement `await using` syntax from Explicit Resource Management proposal
2026-03-16 [JSC] for-using statement should dispose resources when condition is false on first check
2026-03-16 [JSC] Fix null deref in Wasm operationAllocateResultsArray on OOM
2026-03-15 [JSC] Set methods should throw TypeError when iterator next() returns non-object
2026-03-15 [JSC] FTL `CompareStrictEq(Untyped)` should use DFG's JSValue bit-trick fast path
2026-03-14 [JSC] RegExpMatchFastGlobal should have NodeMustGenerate to prevent FTL DCE
2026-03-13 [JSC] Array.prototype.copyWithin should return ToObject(this) when finalIndex < from
2026-03-13 [JSC] DFG strength reduction should not clobber lastIndex found via SetRegExpObjectLastIndex
2026-03-12 [JSC] `RegExp#@@matchAll` fast path should clamp lastIndex > 2^53-1 to 2^53-1
2026-03-11 [libpas] Explicit OOM crash when immortal heap exhausts compact heap reservation
2026-03-10 [JSC] Record RegExp legacy properties on limit abort in Newlines split fast paths
2026-03-10 [JSC] Implement `using` syntax from Explicit Resource Management proposal
2026-03-10 [JSC] DFG should preserve ToNumber side-effect for Math.pow with one argument
2026-03-09 [JSC] `Promise.resolve` with subclass constructor should not return base Promise
2026-03-08 [JSC] Array#flat should skip IsArray at depth 0 and bail fast path for DerivedArrayType
2026-03-07 [JSC] Use `WTF::find64` in `containsHole` for double array
2026-03-07 [JSC] `TypedArray#sort` fails when comparator access `.buffer`
2026-03-07 [JSC] `Array#includes(undefined, fromIndex)` should not find holes before fromIndex
2026-03-05 [JSC] RestParameterNode should use direct binding when possible
2026-03-05 [JSC] Use `tryFindOneChar` for `String#includes`
2026-03-04 [JSC] String#replace should not do surrogate-aware advancement for non-unicode regexps
2026-03-04 [YARR] Skip dead errorCodePoint checks in 16-bit ignoreCase backreference loop for non-Unicode patterns
2026-03-04 [JSC] Add emitBytecodeInConditionContext for ConditionalNode
2026-03-03 [YARR] MultiPatternSIMD scalar loop should not fall into the body with index past end-of-input
2026-03-03 [YARR] Clear captures when backtracking out of positive lookahead in JIT
2026-03-03 [YARR] JIT FixedCount parentheses should restore index on backtrack
2026-03-01 [JSC] Use `std::unique_ptr` for ICU resources in Intl to fix `UEnumeration` leak
2026-02-26 [Yarr] Fix ASSERT failure with case-insensitive backreferences inside RegExp modifier groups
2026-02-26 [YARR] JIT non-greedy backreference should restore index on backtrack failure
2026-02-26 [JSC] Remove redundant to_string in single-expression template literals
2026-02-21 [JSC] VoidNode should use emitNodeInIgnoreResultPosition for its subexpression
2026-02-20 [YARR] Skip dead errorCodePoint check in JIT backreference loop for non-Unicode patterns
2026-02-20 [YARR] Fix operand reversal in non-greedy backreference max count check in JIT
2026-02-19 [YARR] Fix out-of-bounds table access in JIT case-insensitive backreference matching
2026-02-18 [YARR] Fix tryConsumeBackReference pos corruption with surrogate pairs in interpreter
2026-02-18 [YARR] Fix incorrect offset when reading pattern character for Unicode backreference in JIT CVE-2026-43740
2026-02-17 [YARR] Fix word boundary assertion corrupting position with surrogate pairs in bytecode interpreter
2026-02-16 [YARR] Fix false negative matching Unicode regexp with inverted character class
2026-02-16 [YARR] Fix false negative matching Unicode regexp with mixed BMP/non-BMP character class
2026-02-14 [JSC] Use rope concatenation instead of tryMakeString in replace operations for empty strings
2026-02-13 [JSC] Use `UFormattedValue` API in `IntlRelativeTimeFormat::formatToParts`
2026-02-13 [JSC] Add initial support for Windows ARM64
2026-02-12 [JSC] `String#indexOf` should find one char without resolving rope
2026-02-12 [YARR] Fix infinite loop in JIT for non-greedy backreference with insufficient input
2026-02-12 [YARR] Support JIT for forward reference
2026-02-10 [YARR] Fix infinite loop in JIT for non-greedy backreference to zero-width capture
2026-02-09 [JSC] Hanlde RegExp flag getters in DFG/FTL and IC
2026-02-09 [JSC] Handle `String#@@iterator` as `NewInternalFieldObject` in DFG/FTL
2026-02-07 [JSC] Optimize Intl formatToParts methods with pre-built Structure
2026-02-06 [JSC] Optimize `String#endsWith` in DFG/FTL
2026-02-06 [JSC] Limit rope traversal depth in `tryJSSubstringImpl`
2026-02-06 [YARR] Fix stale captures in FixedCount groups in MatchOnly mode
2026-02-05 [YARR] Add JIT support for backreference in MatchOnly mode
2026-02-04 [JSC] Optimize `Intl.Segmenter` segment data object creation with pre-built Structure
2026-02-03 [JSC] Optimize `[...map.keys()]` and `[...map.values()]`
2026-02-03 [JSC] Optimize `Lexer<char16_t>::isWhiteSpace` to avoid ICU calls
2026-02-03 [JSC] Unify NewGenerator and NewAsyncGenerator into NewInternalFieldObject
2026-02-02 [JSC] Optimize `String#trim` with direct span access
2026-01-30 [YARR] Fix capture group reset in JIT-compiled fixed-count non-capturing parentheses
2026-01-29 Add sosuke's new e-mail address
2026-01-29 [JSC] Handle `Object.defineProperty` in DFG/FTL
2026-01-29 [YARR] Add JIT support for non-capturing parentheses with fixed count quantifiers
2026-01-28 [JSC] Optimize `Set#size` and `Map#size` in DFG/FTL and IC
2026-01-28 [JSC] Optimize `String#startsWith` in DFG/FTL
2026-01-26 [JSC] Add `reportBytecodeCacheDecodeTimes` option
2026-01-23 [JSC] Inlining `[...set]` in DFG/FTL
2026-01-23 [Win] Use libpas instead of mimalloc by default on Windows
2026-01-22 [JSC] Use movaps instead of vmovaps in probe trampoline on non-AVX x86_64
2026-01-21 [Win] Fix JSCOnly build on Windows
2026-01-20 [JSC] Use `hasSpecialProperties` bit for cheking `constructor` properties
2026-01-20 [JSC] Handle `String.fromCharCode` in abstract interpreter
2026-01-20 [JSC] Optimize `[...set]`
2026-01-20 [JSC] Handle `StringCodePointAt` in Abastract Interpreter
2026-01-19 [WTF] Use `GetCurrentThreadStackLimits` for Windows stack bounds calculation
2026-01-18 Add commands and skills for Claude Code to `.gitignore`
2026-01-16 [JSC] Add fast path for Array.prototype.slice on ScopedArguments
2026-01-14 [JSC] Merge boolean fields in `JSRegExpStringIterator` into a single bitfield
2026-01-12 [Tools] Fix check-webkit-style false positives for PrintStream::printf
2026-01-10 [YARR] Look up character class table in interpreter
2026-01-10 [JSC] Fix `functionStart` mismatch for async builtin functions
2026-01-10 [JSC] Add `getConstructDataInline`
2026-01-09 [JSC] Add `@@matchAll` to `regExpPrimordialPropertiesWatchpointSet`
2026-01-09 [JSC] Implement `Array.prototype.flat` in C++
2026-01-09 [JSC] Optimize `String#isWellFormed` and `String#toWellFormed` using simdutf
2026-01-08 [JSC] Implement `RegExp#@@matchAll` in C++
2026-01-08 [JSC] Add fast path for `Array.from(map.keys())` and `Array.from(map.values())`
2026-01-05 [WTF] Use simdutf for UTF-16 to UTF-8 conversion
2026-01-01 [JSC] Add fast path for Array.from(set)
2025-12-31 [WTF] Optimize `String::fromUTF8` using simdutf
2025-12-30 [JSC] Remove unused `@setClone`
2025-12-30 [JSC] Implement `String#padStart` and `String#padEnd` in C++
2025-12-29 [JSC] Add fast path for `Array.from(arguments)` in strict mode
2025-12-29 [JSC] Use `hasSpecialProperties` for checking iterable
2025-12-29 [JSC] Treat unused catch binding as optional catch binding
2025-12-27 [JSC] Implement `String#repeat` in C++
2025-12-25 [JSC] Implment `@InternalPromise.@internalAll` in C++
2025-12-25 [WTF] Use `OS(WINDOWS)` instead of `PLATFORM(WIN)`
2025-12-22 [JSC] Handle `String.prototype.includes` in DFG/FTL
2025-12-22 Unreviewed, remove unused `speculateNotOther` from `FTLLowerDFGToB3`
2025-12-20 [JSC] Implement `String.prototype.concat` in C++
2025-12-12 [JSC] Implment `@InternalPromise.@internalAll` in C++
2025-12-11 [JSC] Use default initializer for `Node*` array
2025-12-08 [CMake] Revert `USE_APPLE_ICU` deletion
2025-12-08 [JSC] Implement `String.prototype.concat` in C++
2025-12-07 [JSC] Handle `Object.hasOwn` in DFG/FTL
2025-12-05 [JSC] Optimize 2 args `String#concat` call
2025-12-05 Unreviewed, update test262 config and results
2025-12-04 [JSC] Implement `Promise.race` in C++
2025-12-04 [JSC] Handle `StringIndexOf` in DFG's strength reduction phase
2025-12-04 [JSC] Replace `isValidISODate` with `isDateTimeWithinLimits` in `TemporalCalendar::monthDayFromFields`
2025-12-01 [JSC] Use `if constexpr` for `ByteCodeParser::parseGetById`
2025-11-27 Unreviewed, update test262 Nov 27, 2025
2025-11-25 [JSC] Fix UBSan crash for null butterfly
2025-11-14 [JSC] Implement `Promise.race` in C++
2025-11-13 [JSC] Assert arguments of `CachedCall::callWithArguments` using `Integrity::auditCell`
2025-11-12 [JSC] Add new internal microtask `PromiseFirstResolveWithoutHandlerJob` for `Promise.race`
2025-11-12 [JSC] Add fast path for `Array.from(arguments)`
2025-11-05 [JSC] Implement `Promise.race` in C++
2025-11-05 [JSC] Optimize `Array#of` in DFG/FTL
2025-11-05 [JSC] Remove `@neverInline` attribute
2025-11-01 [JSC] Handle `Promise#catch` in DFG/FTL
2025-10-29 [JSC] Enable async stack trace with TLA
2025-10-28 [WTF] Fix preprocessor directives for `permanentlyFreezePages`
2025-10-28 [JSC] Move `insertChecks()` calls to before adding nodes in `DFGByteCodeParser`

1 / 31

← All Contributors