The patch is in JavaScriptCore’s YARR regex engine, in CharacterClassConstructor, which builds the internal representation of a regular-expression character class. The change adds std::sort calls in two places: after collecting asciiMatches/unicodeMatches, and after collecting matches/matchesUnicode (alongside utf32Strings), immediately before performOp() and performSetOpWithMatches()/performSetOpWithStrings() are invoked. The added stress test exercises character classes using the ES2024 RegExp ‘v’ flag with ‘strings’ syntax (\q{…} with alternations like \q{\u{0095}|k}) under the case-insensitive ‘i’ flag. The violated invariant is that the set-operation and range-coalescing routines (performOp / performSetOpWithMatches) assume their input match/range vectors are in sorted order: these algorithms merge, intersect, subtract, and coalesce ranges by walking the vectors in monotonically increasing order and comparing/advancing indices. When the ‘v’ flag with case-folding (i flag) produces individual match code points, folding a character such as U+0095 can append case-equivalent code points out of numeric order relative to previously appended ASCII characters (e.g. ‘k’/’s’), leaving asciiMatches/unicodeMatches (and the matches/matchesUnicode vectors) unsorted. Feeding an unsorted vector into a routine that assumes sorted order breaks the merge invariant, producing incorrect index advancement and out-of-order comparisons.

The fix restores the invariant by explicitly sorting all four vectors before the set/coalesce operations run, guaranteeing the monotonic-order precondition. Note: the exact failure inside performOp/performSetOpWithMatches is not shown in this diff (those bodies are not included), so the precise mechanism by which unsorted input leads to the observed crash is an inference from the nature of sorted-merge algorithms and the fact that the fix is purely ‘sort the inputs first.’ What the commit establishes concretely is that the inputs were not guaranteed sorted and that the set/coalesce operations require sorted input.

Per the CVE, the realistic outcome is an unexpected process crash triggered by compiling a malformed ‘v’-flag character class — a denial-of-service-grade primitive rather than a demonstrated read/write. Whether the unsorted-input traversal yields an exploitable out-of-bounds access or merely an assertion/abort is not shown by this diff; the fix (sorting the inputs) is consistent with either a controlled crash or a bounded OOB during range coalescing, so any escalation toward memory disclosure/RCE is speculative and not established by the commit. The bug is confined to the WebContent (or any JSC-hosting) process where the attacker’s script runs; there is no cross-process or sandbox-boundary effect from this flaw itself.