The DFG and FTL JIT compilers incorrectly replace Checked with Unchecked ArithNegate operations (and vice versa) during Common Subexpression Elimination. This can then be exploited to cause out-of-bounds accesses and potentially other memory safety violations.
c63474f7958ed7b94d4d7df571792f778fb9ea8a94dac6a55e849f3c5a09d7e2