← WebKit Silent-Fix Report — 2026-W22
4e802a14ca [JSC] Don't advance bytecode when reifying inline frames at a checkpoint
severity medium
class LogicError
confidence 0.55
JSC DFG OSR exit
Primitive: wrong bytecode index when reifying inline frames at checkpoint
Triage note: Uses the raw checkpoint bytecode offset instead of the exit-adjusted index, correcting OSR-exit state (exception handler dispatch).
Triage note: Uses the raw checkpoint bytecode offset instead of the exit-adjusted index, correcting OSR-exit state (exception handler dispatch).
Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.
Before / after
Loading diff…