Found by the JAB-036 quickjab port (worker W5) while porting hunk.hpp: the field getters declare a 2-pointer u8s and hand it to a writer that fills 4 pointers, overwriting 16 bytes of the caller's stack on every invocation. gcc flags it -Wstringop-overflow; JSC builds happen to survive, so the suite stays green over live corruption.
jab/hunk.hpp:161 (and sibling getters): u8s buf = {} — two pointers — passed to JABChunkAt(hunk*, u8* buf[4], …).JABChunkAt's JABCDataOf writes all 4 slots: 16 bytes past the u8s object, into adjacent locals/saved registers.quickjab/hunk.c) declares u8 *buf[4] and reads buf[0] — byte-identical results, no smash; jab's own test/hunk.js passes on both, so the corruption is silent today.JABChunkAt; -Wstringop-overflow goes quiet.-fstack-protector build of jab should trip on test/hunk.js before the fix and pass after.