The vulnerability arises from JIT inlining of String.prototype.localeCompare, as shown in the exploit PoC and patch analysis. The commit removes handling of JavascriptString_LocaleCompare in critical JIT components (Inline.cpp, InliningDecider.cpp) and disables its registration as an inlineable built-in (JavascriptLibrary.cpp). These changes directly address the type confusion caused by improper ImplicitCallFlags handling when localeCompare's JavaScript implementation (in Intl.js) was invoked during JIT optimization. The removed functions facilitated unsafe inlining, making them root causes.