Chrome V8 TranslatedState::MaterializeCapturedObjectAt Caching Bug Exploit

Exploit for multiple platform in category dos / poc Chrome: V8: TranslatedState::MaterializeCapturedObjectAt caching bug Here'a snippet of TranslatedState::MaterializeCapturedObjectAt. case JSSETKEYVALUEITERATORTYPE: case JSSETVALUEITERATORTYPE: Handle object = Handle::cast...