← WebKit — 2026-W39
d9fb479bd09e63bd0659cacf0ad8df4431e592db [JSC] Ensure that we do not have Get / Set in B3->Air lowering
not a security fix
confidence 0.1
signal score 7.37
Source/JavaScriptCore/b3
Classified as not security-relevant.
Triage note: Runs fixSSA unconditionally in generateToAir so LowerToAir no longer sees Variable/Get/Set values, replacing the variable-to-tmp handling with RELEASE_ASSERT(variables().isEmpty()) and RELEASE_ASSERT_NOT_REACHED. JIT pipeline simplification/dead-code removal, not a bug fix.
This commit was flagged by the signal scorer and reviewed by AI (not a human). It is listed only so the triage is auditable; there is no root-cause analysis because this is not a vulnerability fix.
Triage note: Runs fixSSA unconditionally in generateToAir so LowerToAir no longer sees Variable/Get/Set values, replacing the variable-to-tmp handling with RELEASE_ASSERT(variables().isEmpty()) and RELEASE_ASSERT_NOT_REACHED. JIT pipeline simplification/dead-code removal, not a bug fix.
This commit was flagged by the signal scorer and reviewed by AI (not a human). It is listed only so the triage is auditable; there is no root-cause analysis because this is not a vulnerability fix.
Structural signals: security_assert (+4.87), area:Source/JavaScriptCore/b3 (+2.5)
Before / after
Loading diff…
On This Page