Google Chrome V8 - Genesis::InitializeGlobal Out-of-Bounds ReadWrite

Google Chrome V8 - Genesis::InitializeGlobal Out-of-Bounds ReadWrite / Bug: The Genesis::InitializeGlobal method initializes the constructor of RegExp as follows: // Builtin functions for RegExp.prototype. Handle regexpfun = InstallFunction global, "RegExp", JSREGEXPTYPE, JSRegExp::kSize +...