Reports

A cookie check that only asked whether the message agreed with itself.; Renderer bytes reached the host app's full codec set — PSD, RAW, EXR.; The blocklist compared strings while AppKit compared identities.

The callback kept the speech engine alive and let its listener die.; The history check read one node and vouched for the entire tree.; A queue that quietly declines work picks the thread your destructor runs on.

A prior fix taught one `End` handler to widen. The parser has two.; DFG liveness is a union over CFG successors. A catch handler isn't one.; A cross-instance tail call installs the callee's bounds limit, then overwrites it.

Omit one argument and the promise-pair bindings hand you an exception cell.; A buffer you can free between assigning it and pressing play.; A compromised renderer names a file it can't read, and Safari hands it back.

Two of four sibling access types never told the collector what they held.; The literal parser knew __proto__ could run script, and guarded the wrong thing.; The dialog handed back a return value from memory the page just freed.

The CORS policy took a detour through the process it was written to contain.; The eval cache kept a raw pointer that nothing was keeping alive.; The array that came back from an OSR exit disagreed with itself about its layout.