CVE-2025-31278

diff --git a/JSTests/stress/osr-availability-heap-materialization-clobbered.js b/JSTests/stress/osr-availability-heap-materialization-clobbered.js
new file mode 100644
index 000000000000..8a508252cd4b
--- /dev/null
+++ b/JSTests/stress/osr-availability-heap-materialization-clobbered.js
@@ -0,0 +1,23 @@
+//@ requireOptions("--validateFTLOSRExitLiveness=1")
+
+// testLoopCount wasn't on our software update branch when this test was added.
+globalThis.testLoopCount ??= 10000;
+
+function opt() {
+    for (let i = 0; i < 5; i++) {
+        function arg() {
+            return arguments;
+        }
+        const arg1 = arg();
+        const arg2 = arg.apply();
+        try {
+            (3881)(arg2);
+        } catch(e) {
+            arg1.toString()
+        }
+    }
+}
+for (let i = 0; i < testLoopCount; i++) {
+    opt();
+}
+gc();
diff --git a/Source/JavaScriptCore/dfg/DFGAvailabilityMap.cpp b/Source/JavaScriptCore/dfg/DFGAvailabilityMap.cpp
index 434172190359..7fbaf5a18792 100644
--- a/Source/JavaScriptCore/dfg/DFGAvailabilityMap.cpp
+++ b/Source/JavaScriptCore/dfg/DFGAvailabilityMap.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2014, 2015 Apple Inc. All rights reserved.
+ * Copyright (C) 2014-2025 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -35,16 +35,25 @@
 
 namespace JSC { namespace DFG {
 
-void AvailabilityMap::pruneHeap()
+AvailabilityMap AvailabilityMap::filterByLiveness(Graph& graph, CodeOrigin where)
 {
+    AvailabilityMap filtered;
+    filtered.m_locals = Operands<Availability>(OperandsLike, m_locals, Availability::unavailable());
+    graph.forAllLiveInBytecode(
+        where,
+        [&] (Operand reg) {
+            filtered.m_locals.operand(reg) = m_locals.operand(reg);
+        });
+
+    // filter the heap.
     if (m_heap.isEmpty())
-        return;
-    
+        return filtered;
+
     NodeSet possibleNodes;
-    
-    for (unsigned i = m_locals.size(); i--;) {
-        if (m_locals[i].hasNode())
-            possibleNodes.addVoid(m_locals[i].node());
+
+    for (unsigned i = filtered.m_locals.size(); i--;) {
+        if (filtered.m_locals[i].hasNode())
+            possibleNodes.addVoid(filtered.m_locals[i].node());
     }
 
     closeOverNodes(
@@ -54,25 +63,18 @@ void AvailabilityMap::pruneHeap()
         [&] (Node* node) -> bool {
             return possibleNodes.add(node).isNewEntry;
         });
-    
-    UncheckedKeyHashMap<PromotedHeapLocation, Availability> newHeap;
+
     for (auto pair : m_heap) {
         if (possibleNodes.contains(pair.key.base()))
-            newHeap.add(pair.key, pair.value);
+            filtered.m_heap.add(pair.key, pair.value);
     }
-    m_heap = WTFMove(newHeap);
+
+    return filtered;
 }
 
 void AvailabilityMap::pruneByLiveness(Graph& graph, CodeOrigin where)
 {
-    Operands<Availability> localsCopy(OperandsLike, m_locals, Availability::unavailable());
-    graph.forAllLiveInBytecode(
-        where,
-        [&] (Operand reg) {
-            localsCopy.operand(reg) = m_locals.operand(reg);
-        });
-    m_locals = WTFMove(localsCopy);
-    pruneHeap();
+    *this = filterByLiveness(graph, where);
 }
 
 void AvailabilityMap::clear()
@@ -97,6 +99,38 @@ void AvailabilityMap::merge(const AvailabilityMap& other)
     }
 }
 
+void AvailabilityMap::validateAvailability(Graph& graph, Node* where) const
+{
+    if (where->origin.exitOK) {
+        for (auto& heapPair : m_heap) {
+            if (heapPair.value.isFlushUseful()) {
+                FlushedAt heapFlushLocation = heapPair.value.flushedAt();
+                // We should always have an SSA value to use for materializations in the heap.
+                DFG_ASSERT(graph, where, heapPair.value.hasNode());
+
+                if (!heapFlushLocation.virtualRegister().isValid()) {
+                    // If we don't have a location on the stack yet then there's not much to validate.
+                    continue;
+                }
+
+                for (unsigned i = 0; i < m_locals.size(); ++i) {
+                    // Look for our flush in the locals it should be there and match our heap location.
+                    Availability localAvailability = m_locals[i];
+
+                    if (localAvailability.flushedAt().virtualRegister() == heapFlushLocation.virtualRegister()) {
+                        if (localAvailability.hasNode() && heapPair.value.node() != localAvailability.node())
+                            DFG_CRASH(graph, where, toCString("Materialization flushed availability ", heapPair.value, " and local flushed availability ", localAvailability, " disagree on which DFG node the same stack slot holds in ", *this).data());
+
+                        if (heapFlushLocation.format() != localAvailability.flushedAt().format())
+                            DFG_CRASH(graph, where, toCString("Materialization should be flushed (", heapPair.value, ") but corresponding local doesn't exist or match (", localAvailability, ") in ", *this).data());
+                        break;
+                    }
+                }
+            }
+        }
+    }
+}
+
 } } // namespace JSC::DFG
 
 #endif // ENABLE(DFG_JIT)
diff --git a/Source/JavaScriptCore/dfg/DFGAvailabilityMap.h b/Source/JavaScriptCore/dfg/DFGAvailabilityMap.h
index 5c674429b11e..8613d5889b4d 100644
--- a/Source/JavaScriptCore/dfg/DFGAvailabilityMap.h
+++ b/Source/JavaScriptCore/dfg/DFGAvailabilityMap.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2014, 2015 Apple Inc. All rights reserved.
+ * Copyright (C) 2014-2025 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -33,7 +33,8 @@
 namespace JSC { namespace DFG {
 
 struct AvailabilityMap {
-    void pruneHeap();
+    AvailabilityMap() = default;
+
     void pruneByLiveness(Graph&, CodeOrigin);
     void clear();
     
@@ -78,6 +79,10 @@ struct AvailabilityMap {
         closeOverNodes(has, add);
     }
     
+    AvailabilityMap filterByLiveness(Graph&, CodeOrigin);
+
+    void validateAvailability(Graph& graph, Node* where) const;
+
     Operands<Availability> m_locals;
     UncheckedKeyHashMap<PromotedHeapLocation, Availability> m_heap;
 };
diff --git a/Source/JavaScriptCore/dfg/DFGOSRAvailabilityAnalysisPhase.cpp b/Source/JavaScriptCore/dfg/DFGOSRAvailabilityAnalysisPhase.cpp
index 0a76ca979260..6dc6f1ceda24 100644
--- a/Source/JavaScriptCore/dfg/DFGOSRAvailabilityAnalysisPhase.cpp
+++ b/Source/JavaScriptCore/dfg/DFGOSRAvailabilityAnalysisPhase.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2013-2021 Apple Inc. All rights reserved.
+ * Copyright (C) 2013-2025 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -95,8 +95,13 @@ public:
 
                 calculator.m_availability = availabilityAtHead(block);
                 
-                for (unsigned nodeIndex = 0; nodeIndex < block->size(); ++nodeIndex)
-                    calculator.executeNode(block->at(nodeIndex));
+                for (unsigned nodeIndex = 0; nodeIndex < block->size(); ++nodeIndex) {
+                    Node* node = block->at(nodeIndex);
+                    calculator.executeNode(node);
+
+                    if (Options::validateFTLOSRExitLiveness()) [[unlikely]]
+                        calculator.m_availability.validateAvailability(m_graph, node);
+                }
                 

diff --git a/JSTests/stress/osr-availability-heap-materialization-clobbered.js b/JSTests/stress/osr-availability-heap-materialization-clobbered.js
new file mode 100644
index 000000000000..8a508252cd4b
--- /dev/null
+++ b/JSTests/stress/osr-availability-heap-materialization-clobbered.js
@@ -0,0 +1,23 @@
+//@ requireOptions("--validateFTLOSRExitLiveness=1")
+
+// testLoopCount wasn't on our software update branch when this test was added.
+globalThis.testLoopCount ??= 10000;
+
+function opt() {
+    for (let i = 0; i < 5; i++) {
+        function arg() {
+            return arguments;
+        }
+        const arg1 = arg();
+        const arg2 = arg.apply();
+        try {
+            (3881)(arg2);
+        } catch(e) {
+            arg1.toString()
+        }
+    }
+}
+for (let i = 0; i < testLoopCount; i++) {
+    opt();
+}
+gc();