← WebKit — 2026-W41
ab081a2baf5481dd649e7213fba08e5c366dd16d [JSC] Allocate registers for locals in BBQ
not a security fix
confidence 0.15
signal score 10.4
Source/JavaScriptCore/jit
Classified as not security-relevant.
Triage note: BBQ (WASM baseline) JIT optimization introducing register-pinned hot locals: assignPinnedLocals/loadPinnedLocals, locals-on-stack tracking, rewritten getLocal/setLocal/teeLocal and flush/unbind bookkeeping, plus a tail-call scratch-scope reordering and a lshiftPtr form change. New feature with its own invariants/ASSERTs, no commit evidence of fixing a pre-existing exploitable miscompilation.
This commit was flagged by the signal scorer and reviewed by AI (not a human). It is listed only so the triage is auditable; there is no root-cause analysis because this is not a vulnerability fix.
Triage note: BBQ (WASM baseline) JIT optimization introducing register-pinned hot locals: assignPinnedLocals/loadPinnedLocals, locals-on-stack tracking, rewritten getLocal/setLocal/teeLocal and flush/unbind bookkeeping, plus a tail-call scratch-scope reordering and a lshiftPtr form change. New feature with its own invariants/ASSERTs, no commit evidence of fixing a pre-existing exploitable miscompilation.
This commit was flagged by the signal scorer and reviewed by AI (not a human). It is listed only so the triage is auditable; there is no root-cause analysis because this is not a vulnerability fix.
Structural signals: security_assert (+3.0), bounds_guard (+4.32), null_guard (+2.59), area:Source/JavaScriptCore/jit (+2.5), large_churn (-2.0)
Before / after
Loading diff…
On This Page