← WebKit — 2026-W41
b7161cda17aa5b36affb52e2b750bd115cd63d7f [JSC] Evaluate constant array literal elements once in ArrayNode::emitBytecode
not a security fix
confidence 0.12
signal score 6.25
Source/JavaScriptCore/runtime
Classified as not security-relevant.
Triage note: ArrayNode::emitBytecode restructured to collect constants into a MarkedArgumentBufferWithSize<16> and memcpy them into the butterfly, with a hasOverflowed() guard that falls back to the safe path. Codegen optimization plus header-inlining refactor of leastUpperBoundOfIndexingTypes; overflow is handled, no pre-existing bug fixed.
This commit was flagged by the signal scorer and reviewed by AI (not a human). It is listed only so the triage is auditable; there is no root-cause analysis because this is not a vulnerability fix.
Triage note: ArrayNode::emitBytecode restructured to collect constants into a MarkedArgumentBufferWithSize<16> and memcpy them into the butterfly, with a hasOverflowed() guard that falls back to the safe path. Codegen optimization plus header-inlining refactor of leastUpperBoundOfIndexingTypes; overflow is handled, no pre-existing bug fixed.
This commit was flagged by the signal scorer and reviewed by AI (not a human). It is listed only so the triage is auditable; there is no root-cause analysis because this is not a vulnerability fix.
Structural signals: null_guard (+1.95), clamp_saturate (+1.8), area:Source/JavaScriptCore/runtime (+2.5)
Before / after
Loading diff…
On This Page