WebKit JSC JIT - ByteCodeParser::handleIntrinsicCall Type Confusion Exploit

WebKit JIT - ByteCodeParser::handleIntrinsicCall Type Confusion Exploit / case ArrayPushIntrinsic: ... if staticcastargumentCountIncludingThis = MINSPARSEARRAYINDEX return false; ArrayMode arrayMode = getArrayModemcurrentInstructionOPCODELENGTHopcall - 2.u.arrayProfile, Array::Write; ... This cod...