In the DFG JIT, a JS array allocation of known constant length was represented by a single fused node type (NewArrayWithConstantSize, with Phantom/Materialize variants) that allocated both the JSArray cell and its backing butterfly. That fusion hid the butterfly allocation from the DFG’s allocation-sinking and supporting analyses: the butterfly was not a first-class allocation the way the object was, so allocation elimination / object sinking, GC modeling (DFGDoesGC), may-exit analysis (DFGMayExit), and effect modeling (DFGClobberize) reasoned about the array without correctly accounting for a separately-lived butterfly. Under array-allocation-elimination (the added tests cover closure-capture, conditional-usage and cross-function cases), that mismatch let the optimizer sink/eliminate or materialize the allocation in a way where the array could reference a butterfly that had not been (re)materialized or had been treated as not needing GC — a use-after-free / stale-butterfly access when the array was materialized at OSR exit or used after sinking.

The fix decomposes the operation: a new NewButterflyWithSize node explicitly allocates the butterfly, and NewArrayWithButterfly (with PhantomNewArrayWithButterfly / PhantomNewButterflyWithSize / MaterializeNewButterflyWithSize variants) builds the array from that butterfly. ConstantFoldingPhase now inserts a NewButterflyWithSize and converts the array node to NewArrayWithButterfly (running CFA carefully so the default folder doesn’t re-handle it), and every analysis (DoesGC, MayExit, FixupPhase, LoopUnrollingPhase, BackwardsPropagation, Clobberize, AbstractInterpreter, CloneHelper, Node conversion) is updated to know both node kinds.

The restored invariant is that the butterfly is a first-class, separately-tracked allocation, so allocation sinking, materialization and GC modeling handle its lifetime correctly and never leave the array pointing at an unmaterialized/freed butterfly.

A DFG allocation-elimination correctness bug where a fused array-plus-butterfly node hid the butterfly from GC/sinking/materialization analyses, producing a use-after-free / stale-butterfly access in the WebContent process. It is reachable from ordinary JS array code that the JIT optimizes, and while the observed effect is a crash, an array pointing at a controlled freed butterfly is a strong path toward type confusion and read/write. Confined to WebContent. Rated medium.