Exploiting Logic Bugs in JavaScript JIT Engines
phrack.org