Reports

Two iframes, two Set prototypes, and the compiled code watching the wrong one.; Instruction selection sank an atomic past memory.grow, onto memory already freed.; The canvas save stack hit its cap, and the cap stopped being a resource limit.

A prior fix taught one `End` handler to widen. The parser has two.; DFG liveness is a union over CFG successors. A catch handler isn't one.; A cross-instance tail call installs the callee's bounds limit, then overwrites it.

The hash check that ran before the script even existed.; A hot defineProperty fold kept a shape but dropped the check it was an object.; A recorded font stays safe on one thread — until a canvas hands it to two.

Omit one argument and the promise-pair bindings hand you an exception cell.; A buffer you can free between assigning it and pressing play.; A compromised renderer names a file it can't read, and Safari hands it back.

The UI process asked the sandbox which site it was talking to.; Two threads, one easing curve, and a reference count that couldn't count.; A frame ID is a name, not a permission — the pasteboard disagreed.

Two of four sibling access types never told the collector what they held.; The literal parser knew __proto__ could run script, and guarded the wrong thing.; The dialog handed back a return value from memory the page just freed.

Closing a page freed the <html> element out from under its own shadow trees.; A scope guard that pinned the string cell but not the bytes you were reading; Streams' pipeTo checked for a fake promise with a cast that never fails

The CORS policy took a detour through the process it was written to contain.; The eval cache kept a raw pointer that nothing was keeping alive.; The array that came back from an OSR exit disagreed with itself about its layout.

The collector was never told where the exit stub parked its pointers; Nine arguments, six registers, and zero bytes reserved for the overflow; A private field read that answers with the prototype's value