# JIT stale map type assumption

Optimized code keeps a cached map or field type after a mutation path fails to deoptimize it

_Area: Memory corruption and native code. Seen in 7 disclosed reports; one confirmed bounty: $250,000; latest 2026-10-13. Updated 2026-10-23._

## How it works
A JIT compiler speculates about an object's shape (its map) or a field's type, then emits code that skips re-checking. The speculation is only safe if every event that could change the shape or type forces a deoptimization of dependent code. The bug is a missing or asymmetric invalidation: a store path, a side-effecting node, or a weak-reference-cleared type that should trigger deopt does not, so optimized code keeps operating on a stale assumption and treats one type as another.

## Where it shows up
- Store paths that handle a degenerate type state in one access mode but not a sibling mode (kStore vs kStoreInLiteral) [E5](https://bugbountylibrary.com/r/p0%3ACVE-2022-3723.md)
- Effect-chain walks that special-case a node (e.g. kJSCreate) without marking inferred maps unreliable [E8](https://bugbountylibrary.com/r/p0%3ACVE-2020-6418.md)
- Global-property stores that skip the map-stability dependency on one branch [E7](https://bugbountylibrary.com/r/p0%3ACVE-2021-30632.md)
- Array ops (pop, element store) assumed side-effect-free while a prototype accessor or negative-index setter can run [E3](https://bugbountylibrary.com/r/p0%3ACVE-2019-17026.md)
- Type checks at function entry but not across loops after reassignment (JScript9, not V8) [E2](https://bugbountylibrary.com/r/p0%3ACVE-2022-41128.md)
- Escape analysis that dematerializes an object but keeps a sub-allocation alive [E6](https://bugbountylibrary.com/r/p0%3ACVE-2022-1364.md)
- Adjacent: mutable boxes (HeapNumber) stored as deopt literals, breaking immutability [E1](https://bugbountylibrary.com/r/blog%3Axbow-com-labs-research-zero-to-calc-in-six-days-inside-xbow-chrome-full-chain.md)

## How to review
The invariant: any operation that can change a map, field type, or element kind must either deoptimize all code depending on the old assumption, or the optimized code must re-validate before use. For each speculation, enumerate every path that mutates the speculated property and confirm each one invalidates. Concretely: diff AccessMode handlers and alias/side-effect tables for asymmetry; check that side-effecting nodes are flagged; confirm degenerate/cleared types generalize symmetrically across access modes; and verify guards cover prototype accessors and out-of-range keys.

## Variants seen
- Asymmetric FieldType generalization on literal stores [E5](https://bugbountylibrary.com/r/p0%3ACVE-2022-3723.md)
- Unstable-map global store skipping deopt [E7](https://bugbountylibrary.com/r/p0%3ACVE-2021-30632.md)
- Side-effect modelling gap in receiver-map inference [E8](https://bugbountylibrary.com/r/p0%3ACVE-2020-6418.md)
- StoreElementHole alias info missing setter side effects [E3](https://bugbountylibrary.com/r/p0%3ACVE-2019-17026.md)
- Type instability across loops after reassignment [E2](https://bugbountylibrary.com/r/p0%3ACVE-2022-41128.md)
- Dematerialized object sharing a backing store [E6](https://bugbountylibrary.com/r/p0%3ACVE-2022-1364.md)
- Mutable HeapNumber reused as deopt literal [E1](https://bugbountylibrary.com/r/blog%3Axbow-com-labs-research-zero-to-calc-in-six-days-inside-xbow-chrome-full-chain.md)

## Impact and severity
Type confusion leading to out-of-bounds read/write, then arbitrary read/write and code execution; one chain reached unsandboxed execution [E1](https://bugbountylibrary.com/r/blog%3Axbow-com-labs-research-zero-to-calc-in-six-days-inside-xbow-chrome-full-chain.md). Severity is high because the confusion is reachable from script and stable enough to weaponize; in-the-wild exploitation occurred [E8](https://bugbountylibrary.com/r/p0%3ACVE-2020-6418.md).

## Evidence
- E1: https://bugbountylibrary.com/r/blog%3Axbow-com-labs-research-zero-to-calc-in-six-days-inside-xbow-chrome-full-chain.md
- E2: https://bugbountylibrary.com/r/p0%3ACVE-2022-41128.md
- E3: https://bugbountylibrary.com/r/p0%3ACVE-2019-17026.md
- E4: https://bugbountylibrary.com/r/blog%3Ablog-calif-io-p-journey-to-root-episode-i-the-maglev.md
- E5: https://bugbountylibrary.com/r/p0%3ACVE-2022-3723.md
- E6: https://bugbountylibrary.com/r/p0%3ACVE-2022-1364.md
- E7: https://bugbountylibrary.com/r/p0%3ACVE-2021-30632.md
- E8: https://bugbountylibrary.com/r/p0%3ACVE-2020-6418.md