← WebKit Silent-Fix Report — 2026-W25
1d2be470ed [JSC] Make poisonedDeadOSRExitValue more crashy and enable this option when build is Debug
severity dev
class Other
confidence 0.45
JSC DFG/FTL OSR exit
Primitive: hardening to crash on dead-variable reads
Triage note: Diagnostic hardening that surfaces DFG/FTL OSR liveness bugs (which are exploitable) at the access site; itself a debug-only mitigation.
Triage note: Diagnostic hardening that surfaces DFG/FTL OSR liveness bugs (which are exploitable) at the access site; itself a debug-only mitigation.
Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.
Before / after
Loading diff…