13 Years of Service
65%
Spidermonkey IonMonkey can, during a bailout, leak an internal JS_OPTIMIZED_OUT magic value to the running script. This magic value can then be used to achieve memory corruption.
This link is hidden for visitors. Please Log in or register now.