Lucene search
+L

1 matches found

Exploit DB
Exploit DB
added 2018/04/10 12:0 a.m.31 views

Google Chrome V8 JIT - 'LoadElimination::ReduceTransitionElementsKind' Type Confusion

/ I think this commit has introduced the bug: https://chromium.googlesource.com/v8/v8.git/+/9884bc5dee488bf206655f07b8a487afef4ded9b Reduction LoadElimination::ReduceTransitionElementsKindNode node ... if objectmaps.containsZoneHandleSetsourcemap objectmaps.removesourcemap, zone;...

7.4AI score
SaveExploits0
Rows per page
Query Builder