Home / os / winmobile

JSC DFG ObjectAllocationSinkingPhase Crash

Posted on 03 March 2020

An issue in JSC leaves the data flow graph inconsistent. While fuzzing JavaScriptCore with fuzzilli, the researcher found a crash condition in JSC.

 

TOP