Medium CVSS 4.3 webkit Type Confusion 🔧 Commit mapped

Overview

Medium
Severity
4.3
CVSS
No
Exploited ITW
Fixed
Fix Status
DescriptionProcessing maliciously crafted web content may lead to an unexpected Safari crash
ComponentJSC B3
Bug ClassType Confusion
Tracker316918
Fix commit9a17cd1100ad (WebKit/WebKit) +63/-3
CWECWE-119 (Buffer bounds error)
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
CISA KEVNot listed
CreditedOpenAI Codex Security - Amy Burnett
Disclosed2026-08-17

Background

B3 Procedure usesSIMD
A flag telling B3 the compilation uses SIMD so it configures vector register allocation and codegen; if unset, SIMD ops are mishandled.
OMG tier
JSC’s optimizing WebAssembly compiler built on B3; it must notify B3 when a function uses SIMD.
notifyFunctionUsesSIMD
The hook that should propagate a function’s SIMD usage to the Procedure; it was a no-op.

Root Cause Analysis

This fixes a WebAssembly SIMD miscompilation caused by a typo that left the B3 Procedure’s ‘uses SIMD’ flag unset. B3 must know when a compilation uses SIMD so it configures vector register handling and related codegen correctly (setUsesSIMD sets m_usesSIMD and asserts Options::useWasmSIMD()). Two defects combined: the setter was misspelled setUsessSIMD() (double ’s’), and the WASM OMG IR generator’s notifyFunctionUsesSIMD() — invoked when a WASM function is known to use SIMD — was an empty body that only ASSERTed m_info.usesSIMD(…) and NEVER propagated the fact to B3 (it did not call m_proc.setUsesSIMD()).

As a result, a WASM function that uses SIMD could be compiled with the Procedure’s m_usesSIMD flag still false, so B3/Air generate code without the SIMD-aware handling the vector operations require — a miscompilation that mishandles vector registers/values, corrupting state or crashing.

The fix renames the setter to setUsesSIMD(), makes notifyFunctionUsesSIMD() actually call m_proc.setUsesSIMD() (and adds a usesSIMD() query), so the flag is set whenever a function uses SIMD.

The restored invariant is that B3 is told a compilation uses SIMD before it generates code for SIMD operations.

Key insight
A misspelled setter (setUsessSIMD) and an empty notifyFunctionUsesSIMD meant B3 was never told a WASM function uses SIMD, so it miscompiled the vector code; wiring notifyFunctionUsesSIMD to setUsesSIMD() fixes it.

Attack Path

  1. Compile a SIMD WASM function Run a WebAssembly module whose function uses SIMD so it reaches the OMG tier’s B3 pipeline.
  2. Miss the usesSIMD flag notifyFunctionUsesSIMD did not set the Procedure’s flag, so B3 compiles the function as if it uses no SIMD.
  3. Generate wrong code B3/Air handle vector operations without the SIMD-aware configuration, mismanaging vector registers/values.
  4. Corrupt state / crash The miscompiled SIMD code corrupts execution state in the WebContent process (advisory: crash).

Impact Assessment

A WebAssembly SIMD JIT miscompilation in the WebContent process, reachable from any page running SIMD WASM. Generating code without the SIMD flag mishandles vector registers/values, a memory-safety hazard the advisory rates as a crash that can underpin further corruption.

Changed Functions

FunctionChangeNotes
Procedure::setUsesSIMD (was setUsessSIMD)
Source/JavaScriptCore/b3/B3Procedure.h
modified Fixes the misspelled setter name; sets m_usesSIMD with a RELEASE_ASSERT on Options::useWasmSIMD().
OMGIRGenerator::notifyFunctionUsesSIMD / usesSIMD
Source/JavaScriptCore/wasm/WasmOMGIRGenerator.cpp
modified Now calls m_proc.setUsesSIMD() when a function uses SIMD (previously an empty body with only an ASSERT), and adds a usesSIMD() query.
Procedure::Procedure
Source/JavaScriptCore/b3/B3Procedure.cpp
modified Calls the corrected setUsesSIMD() during construction when usesSIMD is set.

Files Changed

  • JSTests/wasm/stress/inline-wasm-simd-into-non-simd.js
  • Source/JavaScriptCore/b3/B3Procedure.cpp
  • Source/JavaScriptCore/b3/B3Procedure.h
  • Source/JavaScriptCore/wasm/WasmOMGIRGenerator.cpp

Audit Directions

  • SIMD-usage propagation
    Audit all paths that detect SIMD usage (notifyFunctionUsesSIMD and callers) to confirm they set the Procedure flag before codegen.
  • Empty/ASSERT-only notifiers
    Grep the WASM IR generators for notify*/hook methods whose body is only an ASSERT and that fail to propagate state to B3/Air.

Original Bug Report

The reporter's bug is still restricted on the tracker.