The bug is in JSC’s DFG abstract interpreter, specifically the AbstractInterpreter handling of the NewArrayWithSpread node in DFGAbstractInterpreterInlines.h. When compiling under the HavingABadTime watchpoint (i.e., array prototypes are unmodified) and the node has a single spread child whose bit is set, the FTL lowering (compileNewArrayWithSpread in FTLLowerDFGToB3.cpp) produces a CopyOnWrite contiguous array in essentially all sub-cases: a PhantomSpread of a PhantomNewArrayBuffer, a PhantomSpread of a PhantomCreateRest, or a directly-lowered immutable butterfly. The abstract interpreter, however, only proved the result was a CopyOnWrite original array (originalArrayStructureForIndexingType(CopyOnWriteArrayWithContiguous)) for the narrow case where the spread wrapped a PhantomNewArrayBuffer with a contiguous indexing type; for every other single-child spread shape it fell through to a broader/less-precise structure set (originalArrayStructureForIndexingType(ArrayWithContiguous) plus the CopyOnWrite variant, or the non-original ArrayWithContiguous during allocation). This is an inconsistency between what the FTL backend actually allocates and what the abstract value model claims: the AI over- or mis-approximated the result structure relative to the concrete allocation, violating the invariant that the abstract interpreter’s proven structure must match (soundly and precisely) the structure the backend emits. Downstream optimizations that trust the AI’s structure set (for example CSE/structure checks and array-access lowering such as the .at() access in the test) can then operate on an array whose real structure differs from the assumed one.

The fix refactors compileNewArrayWithSpread so both the PhantomNewArrayBuffer and PhantomCreateRest cases go through shared helpers (createContiguousImmutableButterflyFromPhantomNewArrayBuffer / …FromPhantomCreateRest) that always yield a contiguous CopyOnWrite immutable butterfly, and correspondingly simplifies the AbstractInterpreter so that for the single-set-bit spread case it uniformly sets the node’s structure to originalArrayStructureForIndexingType(CopyOnWriteArrayWithContiguous), and otherwise to arrayStructureForIndexingTypeDuringAllocation(ArrayWithContiguous). This realigns the abstract structure with what is actually allocated, closing the mismatch. It is an inference (not shown verbatim in the diff) that the concrete downstream misuse is a type-confusion/OOB via an array-access node trusting the wrong structure; the diff shows the AI/lowering mismatch and a regression test that exercises spread + element write + out-of-range .at().

The patch corrects a mismatch between the abstract interpreter’s proven result structure for single-child NewArrayWithSpread and the CopyOnWrite contiguous array the FTL backend actually allocates. A structure/indexing-type misprediction that downstream array accesses trust is a classic route to type confusion or out-of-bounds indexed access, which in JSC is a strong primitive that has historically been escalated toward arbitrary read/write and RCE; however, the diff and regression test only demonstrate a crash, and any escalation beyond that is inference, not established by the commit. The bug is confined to the sandboxed WebContent (renderer) process. The advisory characterizes it as an unexpected process crash, consistent with a controlled fault, while the underlying AI-imprecision class is the concerning part.