Microsoft Edge Chakra JIT Type Confusion Bug

Microsoft Edge: Chakra: JIT: Type confusion bug CVE-2018-8467 The switch statement only handles Js::TypeIdsArray but not Js::TypeIdsNativeIntArray and Js::TypeIdsNativeFloatArray. So for example, a native float array can be considered as of type ObjectType::Object under certain circumstances wher...