This fixes an unchecked hash-map iterator dereference in JavaScriptCore’s Web Inspector debugger agent. InspectorDebuggerAgent::didScheduleAsyncCall records async call stack traces; when there is a current async call on the stack it looks up the parent: auto it = m_pendingAsyncCalls.find(m_currentAsyncCallIdentifierStack.last()); ASSERT(it != m_pendingAsyncCalls.end()); parentStackTrace = it->value;. The ASSERT documents the expectation that the entry exists, but assertions are compiled out in release builds, so if the identifier is not actually present, find() returns the end() iterator and it->value dereferences that invalid end iterator — an out-of-bounds read of a HashMap bucket (reading and using garbage as the parent stack trace).

The fix guards the dereference with if (LIKELY(it != m_pendingAsyncCalls.end())) parentStackTrace = it->value;, so a missing entry is handled instead of dereferenced.

The restored invariant is that the iterator is validated before use in release builds, not only asserted. NOTE: this code lives in the inspector/automation debugger agent, so reachability from ordinary web content depends on that instrumentation being active; the diff establishes the defensive iterator fix, while the advisory’s arbitrary-code-execution rating implies a stronger path that this one-file change does not fully show (marked as inference).

An out-of-bounds read from an unchecked end() iterator in the WebContent process’s inspector agent; the advisory rates it arbitrary code execution. The shown change is a defensive iterator guard, so the demonstrated primitive is an OOB read; a fuller exploit path is not evident in this one-file diff and reachability depends on async-call instrumentation being active.