Reports

Sixteen storage handlers took an integer as proof you owned the file.; Another site's cache will happily serve back what you wrote into it.; A shadow-DOM cache that outlived the table it was stored inside.

The per-thread isolation held at every level except the one that made levels.; Overwriting a callback was a free, and a real-time thread was inside it.; Three code paths dropped the pointer. Only the destructor remembered to detach.

Omit one argument and the promise-pair bindings hand you an exception cell.; A buffer you can free between assigning it and pressing play.; A compromised renderer names a file it can't read, and Safari hands it back.

The UI process asked the sandbox which site it was talking to.; Two threads, one easing curve, and a reference count that couldn't count.; A frame ID is a name, not a permission — the pasteboard disagreed.

The CORS policy took a detour through the process it was written to contain.; The eval cache kept a raw pointer that nothing was keeping alive.; The array that came back from an OSR exit disagreed with itself about its layout.

B3 was right that the value was dead — the collector agreed, and freed it.; The DFG certified a property absent from an object that owned it outright.; An IC exit undid a stack adjustment that had never happened.

The collector was never told where the exit stub parked its pointers; Nine arguments, six registers, and zero bytes reserved for the overflow; A private field read that answers with the prototype's value