Wow. If I understand, your .name example kinda blows my mind. So that would be where the JIT compiler might be pre-optimized to expect a certain length for a supposedly immutable parameter... right? Even if the spec makes everthing mutable. I didn't know that was part of the optimization, but it makes some sense.
That makes it possible for me to visualize how a use-after-free might work inside a JIT engine's sandbox. If I'm not misunderstanding, you're saying that the type confusion attack could be accessed by changing something as simple as the prototype for Object, in a way that the JIT compiler was hardcoded to ignore? Essentially that the compiler is not built to spec, and then getting the garbage collector to somehow free the extra memory, it's still possible to open a hole to read sequential blocks. But the main flaw would be that the compiler reserves X memory for quickly writing an object and then in some unoptimized phase sees that the object only took up X-y and reuses a portion of it...?
I'm a high school dropout..Am I seeing this right?
That makes it possible for me to visualize how a use-after-free might work inside a JIT engine's sandbox. If I'm not misunderstanding, you're saying that the type confusion attack could be accessed by changing something as simple as the prototype for Object, in a way that the JIT compiler was hardcoded to ignore? Essentially that the compiler is not built to spec, and then getting the garbage collector to somehow free the extra memory, it's still possible to open a hole to read sequential blocks. But the main flaw would be that the compiler reserves X memory for quickly writing an object and then in some unoptimized phase sees that the object only took up X-y and reuses a portion of it...?
I'm a high school dropout..Am I seeing this right?