Microsoft Edge Chakra JIT BailOutOnInvalidatedArrayHeadSegment Check Bypass

Microsoft Edge: Chakra: JIT: BailOutOnInvalidatedArrayHeadSegment check bypass CVE-2018-8466 The BailOutOnInvalidatedArrayHeadSegment check uses the JavascriptArray::GetArrayForArrayOrObjectWithArray method to check whether the given object is an array. If it's not an array, it will decide to ski...