CVE-2026-64780
Overview
Background
- B3 Procedure usesSIMD
- A flag telling B3 the compilation uses SIMD so it configures vector register allocation and codegen; if unset, SIMD ops are mishandled.
- OMG tier
- JSC’s optimizing WebAssembly compiler built on B3; it must notify B3 when a function uses SIMD.
- notifyFunctionUsesSIMD
- The hook that should propagate a function’s SIMD usage to the Procedure; it was a no-op.
Root Cause Analysis
This fixes a WebAssembly SIMD miscompilation caused by a typo that left the B3 Procedure’s ‘uses SIMD’ flag unset. B3 must know when a compilation uses SIMD so it configures vector register handling and related codegen correctly (setUsesSIMD sets m_usesSIMD and asserts Options::useWasmSIMD()). Two defects combined: the setter was misspelled setUsessSIMD() (double ’s’), and the WASM OMG IR generator’s notifyFunctionUsesSIMD() — invoked when a WASM function is known to use SIMD — was an empty body that only ASSERTed m_info.usesSIMD(…) and NEVER propagated the fact to B3 (it did not call m_proc.setUsesSIMD()).
As a result, a WASM function that uses SIMD could be compiled with the Procedure’s m_usesSIMD flag still false, so B3/Air generate code without the SIMD-aware handling the vector operations require — a miscompilation that mishandles vector registers/values, corrupting state or crashing.
The fix renames the setter to setUsesSIMD(), makes notifyFunctionUsesSIMD() actually call m_proc.setUsesSIMD() (and adds a usesSIMD() query), so the flag is set whenever a function uses SIMD.
The restored invariant is that B3 is told a compilation uses SIMD before it generates code for SIMD operations.
Attack Path
- Compile a SIMD WASM function Run a WebAssembly module whose function uses SIMD so it reaches the OMG tier’s B3 pipeline.
- Miss the usesSIMD flag notifyFunctionUsesSIMD did not set the Procedure’s flag, so B3 compiles the function as if it uses no SIMD.
- Generate wrong code B3/Air handle vector operations without the SIMD-aware configuration, mismanaging vector registers/values.
- Corrupt state / crash The miscompiled SIMD code corrupts execution state in the WebContent process (advisory: crash).
Impact Assessment
Changed Functions
| Function | Change | Notes |
|---|---|---|
Procedure::setUsesSIMD (was setUsessSIMD)Source/JavaScriptCore/b3/B3Procedure.h |
modified | Fixes the misspelled setter name; sets m_usesSIMD with a RELEASE_ASSERT on Options::useWasmSIMD(). |
OMGIRGenerator::notifyFunctionUsesSIMD / usesSIMDSource/JavaScriptCore/wasm/WasmOMGIRGenerator.cpp |
modified | Now calls m_proc.setUsesSIMD() when a function uses SIMD (previously an empty body with only an ASSERT), and adds a usesSIMD() query. |
Procedure::ProcedureSource/JavaScriptCore/b3/B3Procedure.cpp |
modified | Calls the corrected setUsesSIMD() during construction when usesSIMD is set. |
Files Changed
JSTests/wasm/stress/inline-wasm-simd-into-non-simd.jsSource/JavaScriptCore/b3/B3Procedure.cppSource/JavaScriptCore/b3/B3Procedure.hSource/JavaScriptCore/wasm/WasmOMGIRGenerator.cpp
Audit Directions
- SIMD-usage propagationAudit all paths that detect SIMD usage (notifyFunctionUsesSIMD and callers) to confirm they set the Procedure flag before codegen.
- Empty/ASSERT-only notifiersGrep the WASM IR generators for notify*/hook methods whose body is only an ASSERT and that fail to propagate state to B3/Air.