This fixes an unsigned integer overflow in WTF::HashTable’s size computation that could produce an undersized table allocation and subsequent out-of-bounds access. computeBestTableSize() and rehash() computed table sizes with plain unsigned arithmetic: bestTableSize = roundUpToPowerOfTwo(keyCount) followed by conditional doublings (bestTableSize *= 2), and rehash() derived newSize from oldSize. For a hash table driven to a very large key count, these unsigned multiplications/roundings can overflow 2^32 and wrap to a small value, so the table is allocated far smaller than the number of entries it must hold; reinserting entries then indexes past the allocation — an out-of-bounds read/write and heap corruption.

The fix converts the size accounting to Checked<unsigned> (newSize, oldSize, bestTableSize, and rehash’s newTableSize parameter) so any overflow in the rounding or doubling traps instead of silently wrapping, and returns std::max(bestTableSize.value(), minimumTableSize). It also adds deleteReleasedWeakBuckets(), which sweeps released weak buckets (decrementing keyCount, incrementing deletedCount) before rehash so the count feeding the size computation reflects reclaimed weak entries.

The restored invariant is that table-size math cannot silently wrap to an undersized allocation. The precise overflowing multiply is one of the bestTableSize *= 2 / roundUpToPowerOfTwo steps now wrapped in Checked<unsigned>.

A heap out-of-bounds write primitive in the WebContent process, driven by inflating a hash table’s key count until its size computation overflows and under-allocates. Size-overflow-to-undersized-allocation is a classic, strong corruption primitive; the advisory rates it a crash, but the class supports controlled heap corruption toward code execution.