← WebKit — 2026-W37
41ec81351b41fd60b018e9f6f399a602a4a1b496 [JSC] Lower Mul(Neg(n), m) to MNEG/FNMUL
not a security fix
confidence 0.1
signal score 8.17
Source/JavaScriptCore/b3
Classified as not security-relevant.
Triage note: Adds a B3->Air MNEG/FNMUL fused multiply-negate lowering (tryAppendMultiplyNegOperand) with canBeInternal/m_locked guards plus extensive correctness tests. New JIT optimization, not a fix to an existing miscompile.
This commit was flagged by the signal scorer and reviewed by AI (not a human). It is listed only so the triage is auditable; there is no root-cause analysis because this is not a vulnerability fix.
Triage note: Adds a B3->Air MNEG/FNMUL fused multiply-negate lowering (tryAppendMultiplyNegOperand) with canBeInternal/m_locked guards plus extensive correctness tests. New JIT optimization, not a fix to an existing miscompile.
This commit was flagged by the signal scorer and reviewed by AI (not a human). It is listed only so the triage is auditable; there is no root-cause analysis because this is not a vulnerability fix.
Structural signals: security_assert (+6.47), null_guard (+1.2), area:Source/JavaScriptCore/b3 (+2.5), large_churn (-2.0)
Before / after
Loading diff…
On This Page