← WebKit Silent-Fix Report — 2026-W34
e88b92e29f0753e644abe33fdbc2b78c051ebf59 [JSC] Fix BBQ i64.mul_wide register assignment in x64
severity medium
class TypeConfusion
confidence 0.55
Wasm BBQ JIT
Primitive: BBQ i64.mul_wide x64 register assignment can destroy low result half
Triage note: Fixes register move sequencing for mul_wide where results in rdx:rax with resultLo=rdx/resultHi=rax destroyed the low half; a JIT miscompile yielding wrong wide-arithmetic results under register pressure.
Triage note: Fixes register move sequencing for mul_wide where results in rdx:rax with resultLo=rdx/resultHi=rax destroyed the low half; a JIT miscompile yielding wrong wide-arithmetic results under register pressure.
Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.
Before / after
Loading diff…