Microsoft Edge Chakra JIT - NewScObjectNoCtor Array Type Confusion Exploit

Exploit for windows platform in category dos / poc / This is similar to the previous issues 1457, 1459 MSRC 42551, MSRC 42552. If a JavaScript function is used as a consturctor, it sets the new object's "proto" to its "prototype". The JIT compiler uses NewScObjectNoCtor instructions to perform it...