The vulnerability stems from two key issues: 1) In GlobOptFields.cpp, the ProcessFieldKills function was missing conditional checks for inlined functions with arguments, leading to improper field invalidation during array operations. 2) In Lower.cpp, the NewScObjectNoCtor handling lacked proper bailout checks and helper call logic, creating unsafe object initialization paths. Both were directly addressed in the security patches (936a5af/d797e3f) through added argument presence checks and bailout validation, correlating with the CWE-787 description of out-of-bounds writes via memory handling errors.