Microsoft Windows - Multiple Use-After-Free Issues in jscript Array Methods

!-- There are multiple use-after-free issues in Array methods in jscript. When jscript executes an Array method such as Array.join, it first retrieves the length of an array. If the input is not an array but an object, then the length property of the object is going to be retrieved and converted ...