JSC Argument Object Reconstruction Type Confusion

JSC suffers from a type confusion vulnerability during bailout when reconstructing arguments objects.

Leave a Reply