This fixes an out-of-bounds access caused by a length field that could desynchronize from the backing buffer in JSC’s ScopedArgumentsTable (and its bytecode-cache serialization). ScopedArgumentsTable stored a separate m_length alongside m_arguments (the scope-offset array) and a parallel m_watchpointSets array; various operations (tryCreate, tryClone, trySetLength) and the CachedScopedArgumentsTable encode/decode used m_length to size and index m_arguments. If m_length and the actual m_arguments buffer size diverged — e.g. an allocation grew one but not the other, or the cached m_length did not match the real arguments array — code indexing m_arguments by m_length would read or write past the buffer, an out-of-bounds access (memory corruption / crash).

The fix removes the redundant m_length and derives the length from m_arguments.size(), makes m_arguments and m_watchpointSets growable together via checked tryGrow (both grown to the same new length, failing atomically), and uses spans for encode/decode (m_arguments.span().data() / mutableSpan().data()) so the serialized length always matches the buffer. tryClone now copies m_arguments/m_watchpointSets wholesale, and trySetLength grows both arrays consistently.

The restored invariant is that the arguments length is always exactly the buffer size and the two parallel arrays stay the same length, so no index derived from length can exceed the allocation. INFERENCE: the exact trigger that desynchronized length and buffer is not shown in this hunk; the patch removes the separate length field that made the desync possible.

An out-of-bounds access in the WebContent process from a ScopedArgumentsTable whose length could diverge from its backing buffer, reachable via scoped-arguments usage (and cached bytecode). The advisory rates it a crash; length/buffer desync OOBs are controllable memory-safety bugs.