← WebKit Silent-Fix Report — 2026-W22
f181acea44 [JSC] `Array.prototype.join` skips prototype element added during element toString
severity low
class LogicError
confidence 0.40
JSC ArrayPrototype join
Primitive: stale holesKnownToBeOK after element toString side effect
Triage note: Corrects handling of holes forwarding to prototype after a side effect; primarily an observable-correctness fix.
Triage note: Corrects handling of holes forwarding to prototype after a side effect; primarily an observable-correctness fix.
Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.
Before / after
Loading diff…