Spidermonkey IonMonkey Incorrect Prediction

Spidermonkey IonMonkey incorrectly predicts return type of Array.prototype.pop, leading to type confusion vulnerabilities.

Leave a Reply