← WebKit Silent-Fix Report — 2026-W22
cdfa73fdc3 [JSC] DFG object allocation sinking shouldn't insert a check when given a PutByVal node
severity medium
class TypeConfusion
confidence 0.50
JSC DFG allocation sinking
Primitive: invalid exit state / graph in object allocation sinking
Triage note: Fixes DFG allocation-sinking exit-state clobberization and removes an over-strict validation rule, a JIT soundness area.
Triage note: Fixes DFG allocation-sinking exit-state clobberization and removes an over-strict validation rule, a JIT soundness area.
Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.
Before / after
Loading diff…