In 2020, a security researcher flagged a peculiar bug in Hermes’s Quicksort implementation. Here’s how security teams at Meta fixed the bug.