← WebKit Silent-Fix Report — 2026-W25
357d3881fd [JSC] Object.freeze / Object.seal need to reify special properties
severity low
class LogicError
confidence 0.45
JSC JSObject
Primitive: frozen-object invariant violation
Triage note: Failing to reify lazy own properties before freeze/seal can leave the frozen invariant inconsistent, which engine optimizations depend on.
Triage note: Failing to reify lazy own properties before freeze/seal can leave the frozen invariant inconsistent, which engine optimizations depend on.
Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.
Before / after
Loading diff…