WebKit JSC - JSGlobalObject::haveABadTime Causes Type Confusions

WebKit JSC - JSGlobalObject::haveABadTime Causes Type Confusions switchToSlowPutArrayStoragevm; = MINSPARSEARRAYINDEX || structurevm-holesMustForwardToPrototypevm return nullptr; Structure resultStructure = exec.l...

WebKit JSC JSGlobalObject::haveABadTime Type Confusion

WebKit: JSC: JSGlobalObject::haveABadTime causes type confusions CVE-2017-7005 After JSGlobalObject::haveABadTime is called, the type of all JavaScript arraysincluding newly created arrays are of the same type: ArrayWithSlowPutArrayStorage. But of course this only affects objects that share the...