syg
JSC security specialist
Summary
Works almost exclusively in JSC, with occasional WTF touches; the stream is dominated by correctness fixes across the JIT and runtime rather than feature work, and nothing lands as generic hardening. The security-relevant commits fall into three recurring buckets: inline-cache and structure-caching invalidation (megamorphic get_by_id throw scopes, adaptive watchpoint `isValid` overrides, caching property absence on dictionaries), GC lifetime and missing write barriers (MultiPutByOffset storage reallocation, deferring GC around the direct-eval cache key), and Wasm object lifetime/threading (JSWebAssemblyMemory keepalive for wasm-originated ArrayBuffers, private names on WasmGC objects, name-section parsing). Systematic-variant candidate: the JS↔Wasm object boundary — several distinct wasm-originated lifetime bugs landed within days of each other, which suggests the surface hasn't been exhausted.
Components
Security Fix History
- 2026-07-02 [JSC] getByIdMegamorphic needs a throw scope ·
- 2026-07-01 [JSC] Override isValid() on AdaptiveValuePropertyInlineCacheClearingWatchpoint ·
- 2026-06-30 [JSC] Do not cache property absence on dictionaries ·
- 2026-06-30 [JSC] Disallow defining private names on WasmGC objects ·
- 2026-06-30 [JSC] Insert barrier for MultiPutByOffset when it can reallocate storage ·
- 2026-06-29 [JSC] Keep JSWebAssemblyMemory alive from wasm-originated JSArrayBuffers ·
- 2026-06-16 [JSC] Take slow path in LiteralParser if original structure changes 2026-W24
- 2026-06-11 [JSC] Promise.resolve should not folded to identity on Promise subclasses ·
- 2026-06-11 [JSC] Make wasm name section parsing threadsafe ·
- 2026-05-30 [JSC] Defer GC while using the direct eval CacheLookupKey 2026-W22
Hardening Commits
- No hardening commits recorded
Recent Commits
- 2026-08-05 [JSC] Use FrameTracer in wasm ref_func, table_get, and array_init_elem operations 2026-W31
- 2026-07-31 [YARR] Don't save sibling and ancestor sibling frame slots for ParenContext
- 2026-07-23 [JSC] Materialize .length/.name for bound^2 functions
- 2026-07-20 [JSC] Wasm-backed resizable ArrayBuffers should throw for all invalid sizes
- 2026-07-17 [JSC] Swap base and offset registers in branchTest{8,16}
- 2026-07-02 [JSC] getByIdMegamorphic needs a throw scope ·
- 2026-07-01 [JSC] Override isValid() on AdaptiveValuePropertyInlineCacheClearingWatchpoint ·
- 2026-06-30 [JSC] Do not cache property absence on dictionaries ·
- 2026-06-30 [JSC] Disallow defining private names on WasmGC objects ·
- 2026-06-30 [JSC] Insert barrier for MultiPutByOffset when it can reallocate storage ·
- 2026-06-29 [JSC] Keep JSWebAssemblyMemory alive from wasm-originated JSArrayBuffers ·
- 2026-06-16 [JSC] Take slow path in LiteralParser if original structure changes 2026-W24
- 2026-06-11 [JSC] Promise.resolve should not folded to identity on Promise subclasses ·
- 2026-06-11 [JSC] Make wasm name section parsing threadsafe ·
- 2026-06-05 [JSC] Fix opcode assert for Array.p.sort OSR exit