V8’s optimizing tiers cache type/field/representation facts to elide checks and reuse loads. But a CheckMaps with kTryMigrateInstance, a deopt materialization, an in-place map reconfigure (Smi→Double via a mutable HeapNumber), or phi untagging can change the object’s actual shape mid-stream.

When the optimizer fails to kill the dependent assumption at that edge, it reuses a stale PropertyArray/in-object load or an elided CheckSmi/CheckHeapObject, reading the post-change bytes with the pre-change type. That is a type confusion — a tagged pointer read as a Smi, a double read as an object pointer — and a direct path to arbitrary read/write in the renderer.

Invalidate the dependent state on the exact map-changing edge:

• KillFields/KillConstField on a CheckMaps that carries a migrate flag (LoadElimination).
• Re-add the widened type (UnionType(kHeapNumber)) after stripping kSmi.
• Only elide CheckSmi when the caller says elidable.
• Force a fresh HeapNumber per deopt materialization instead of deduplicating a mutable box.