WebKit JSC ArgumentsEliminationPhase::transform Incorrect LoadVarargs Handling

WebKit: JSC: Incorrect LoadVarargs handling in ArgumentsEliminationPhase::transform CVE-2017-7056 Here is a snippet of ArgumentsEliminationPhase::transform case LoadVarargs: ... if candidate-op == PhantomNewArrayWithSpread || candidate-op == PhantomSpread ... if argumentCountIncludingThis limit...