The DFG JIT compiler attempts to determine whether a DFG IR operation could cause garbage collection (GC) during its execution. If the analysis is incorrect and a GC can happen in between, then the emitted code can cause use-after-free issues, e.g. if an unmarked (white) object is assigned as property to an object that was marked during an unexpected GC (and is thus black). This vulnerability was found through fuzzing and then simplified, triggering an assertion in JSC debug builds.