This is an FTL OSR-exit object-materialization bug in JavaScriptCore’s handling of a PhantomNewArrayWithButterfly sink. When the FTL sinks an array allocation and later has to rematerialize it during an OSR exit, operationMaterializeObjectInOSR chose the array Structure via globalObject->arrayStructureForIndexingTypeDuringAllocation(indexingType). The invariant it relied on is that the indexing type observed at FTL compile time still describes the layout to build at exit time. But the global object can enter ‘having a bad time’ (isHavingABadTime — triggered when an indexed property is defined on Array.prototype/Object.prototype) between FTL compilation and the rematerialization; once that happens, arrayStructureForIndexingTypeDuringAllocation returns a SlowPutArrayStorage structure for every indexing type. The code then rematerialized the butterfly assuming a contiguous/non-ArrayStorage layout while the Structure said SlowPutArrayStorage — a layout mismatch. Writing rematerialized elements (and, in operationPopulateObjectInOSR, clearing ‘hole’ empty JSValues) into the wrong layout corrupts the object/butterfly.

The fix rematerializes with originalArrayStructureForIndexingType (the non-bad-time structure matching how the butterfly is built), and then, if isHavingABadTime(), explicitly calls result->switchToSlowPutArrayStorage(vm) so the final object is converted consistently; correspondingly, operationPopulateObjectInOSR adds a branch to clear a hole in arrayStorage()->m_vector[index] when the indexing type is any ArrayStorage.

The restored invariant is that materialization builds the butterfly and the Structure with a single consistent layout even if a bad-time transition raced the exit.

A JIT correctness bug that produces an array whose Structure and butterfly disagree on layout, i.e. attacker-influenced memory corruption in the WebContent process rather than a mere logic error; the observable in the test is a crash. Building a strong primitive requires precise control of the bad-time timing across an OSR exit, but layout-confusion of a JS array is a classic stepping stone toward type confusion and RW. Confined to WebContent. Rated medium.