WebKit JavaScriptCore - createRegExpMatchesArray Type Confusion

WebKit JavaScriptCore - createRegExpMatchesArray Type Confusion / Prerequisites ------------- In JavaScriptCore, JSObjects have an associated Structure: an object describing various aspects of the JSObject such as its type, its properties, and the type of elements being stored e.g. unboxed double...

WebKit JavaScriptCore - createRegExpMatchesArray Type Confusion Exploit

/ Prerequisites ------------- In JavaScriptCore, JSObjects have an associated Structure: an object describing various aspects of the JSObject such as its type, its properties, and the type of elements being stored e.g. unboxed double or JSValues. Whenever a property is added to an object or some...