The principal sin, IMHO, is that JavaScript technically has only one number type, double. But doubles are pretty slow, particularly if they are used as array indexes, so JS engines do a ton of numerical analysis (range analysis) to determine when it is safe to do integer math. That reasoning is extremely tricky and I've made gazongas amounts of bugs myself. (I'm the original author of the SimplifiedLoweringPass, which has evolved significantly since I last worked on that part of the code--circa 2015). Unfortunately static analysis of any kind really doesn't help...the implementation language (C++) isn't really at fault...because the bugs are manifesting at the compiler IR level, i.e. how it reasons about JS values in the representation of JS code.