vigneshrao-apple
JSC security specialist
Summary
Works exclusively in JavaScriptCore, with the security fixes split between the Wasm JIT tiering machinery (OMGOSREntryCallee and BBQCallee lifetime during callsite collection and repatch) and correctness bugs in the DFG/JIT-adjacent paths — GetByStatus prototype-chain walking for direct property access, and a missing exception check in the RegExp-backed replaceAll cache. Every commit in the window is classified as a security fix rather than defensive hardening, i.e. reactive bug fixing on concrete defects, not preemptive mitigation work. Systematic-variant candidate: the back-to-back callee-liveness fixes suggest the Wasm tier-up repatch path has a general pattern of callees being collected and then used across a point where they can be freed — other JIT callee types reachable from callsite-update code are worth sweeping for the same shape.
Components
Security Fix History
- 2026-06-30 [JSC] Unconditionally keep OMGOSREntryCallee alive while updating its callsites ·
- 2026-06-16 [JSC] BBQCallee should be kept alive between callsite collection and repatch ·
- 2026-05-27 replaceAllWithCacheUsingRegExpSearchThreeArguments fails to throw exception in string resolution
- 2026-05-21 [JSC] GetByStatus::computeFor should not walk proto chain for direct property access 2026-W20
Hardening Commits
- No hardening commits recorded
Recent Commits
- 2026-06-30 [JSC] Unconditionally keep OMGOSREntryCallee alive while updating its callsites ·
- 2026-06-16 [JSC] BBQCallee should be kept alive between callsite collection and repatch ·
- 2026-05-27 replaceAllWithCacheUsingRegExpSearchThreeArguments fails to throw exception in string resolution
- 2026-05-21 [JSC] GetByStatus::computeFor should not walk proto chain for direct property access 2026-W20