Spidermonkey IonMonkey can, during a bailout, leak an internal JS_OPTIMIZED_OUT magic value to the running script. This magic value can then be used to achieve memory corruption.
21e617fce84dfd81b604a208a22a2b6eddb28a37714ca8e794f2f450afc722a0
© 2022 Packet Storm. All rights reserved.