Using Hermes’s Quicksort to run Doom: A tale of JavaScript exploitationengineering.fb.com·4 pts·jtuple·0