Reports

Omit one argument and the promise-pair bindings hand you an exception cell.; A buffer you can free between assigning it and pressing play.; A compromised renderer names a file it can't read, and Safari hands it back.

Two of four sibling access types never told the collector what they held.; The literal parser knew __proto__ could run script, and guarded the wrong thing.; The dialog handed back a return value from memory the page just freed.

The CORS policy took a detour through the process it was written to contain.; The eval cache kept a raw pointer that nothing was keeping alive.; The array that came back from an OSR exit disagreed with itself about its layout.