Webkit JavascriptCore Array unshift function had a race condition, it leads to RCE. - View it on GitHub