← WebKit Silent-Fix Report — 2026-W22
8a7e39c2bf [JSC] Array ToPrimitive fast path ignores Array.prototype.valueOf override
severity low
class LogicError
confidence 0.45
JSC JSArray toPrimitive
Primitive: fast path ignores overridden Array.prototype.valueOf
Triage note: Fast path returned wrong primitive when Array.prototype.valueOf was overridden; an observable-correctness/soundness fix, no clear memory primitive.
Triage note: Fast path returned wrong primitive when Array.prototype.valueOf was overridden; an observable-correctness/soundness fix, no clear memory primitive.
Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.
Before / after
Loading diff…