anvbis

Fundamentals:
-------------
https://jayconrod.com/posts/51/a-tour-of-v8--full-compiler
https://jayconrod.com/posts/52/a-tour-of-v8--object-representation
https://jayconrod.com/posts/54/a-tour-of-v8--crankshaft--the-optimizing-compiler
https://jayconrod.com/posts/55/a-tour-of-v8--garbage-collection
https://v8.dev/blog/fast-properties
https://developpaper.com/how-does-v8-run-object-representation-in-v8/
https://medium.com/@stankoja/v8-bug-hunting-part-2-memory-representation-of-js-types-ea37571276b8
https://jayconrod.com/posts/44/polymorphic-inline-caches-explained

anvbis

let _buf = new ArrayBuffer(8);
let _flt = new Float64Array(_buf);
let _int = new BigUint64Array(_buf);

const itof = x => {
  _int[0] = x;
  return _flt[0];
};

const pwn = () => {

anvbis

let _buf = new ArrayBuffer(8);
let _flt = new Float64Array(_buf);
let _int = new BigUint64Array(_buf);

const ftoi = x => {
  _flt[0] = x;
  return _int[0];
};

const itof = x => {

anvbis

filetype plugin indent on
set tabstop=2
set shiftwidth=2
set expandtab

set number
set termguicolors


" https://github.com/junegunn/vim-plug

anvbis

/*
HEAD @ b5fa92428c9d4516ebdc72643ea980d8bde8f987
*/

let buf = new ArrayBuffer(8);
let f64 = new Float64Array(buf);
let i64 = new BigUint64Array(buf);

const ftoi = x => {
  f64[0] = x;

anvbis

CVE-2023-2033
CVE-2023-1214
CVE-2023-0696
CVE-2022-4262
CVE-2022-4174
CVE-2022-3889
CVE-2022-3885
CVE-2022-3723
CVE-2022-3652
CVE-2022-3045

anvbis

source 'https://rubygems.org' do
  gem 'seccomp-tools'
end

anvbis

diff --git a/js/src/builtin/Array.cpp b/js/src/builtin/Array.cpp
index 2b6d8953c523..fa60ef14f1ec 100644
--- a/js/src/builtin/Array.cpp
+++ b/js/src/builtin/Array.cpp
@@ -206,6 +206,20 @@ bool js::GetLengthProperty(JSContext* cx, HandleObject obj, uint64_t* lengthp) {
   return ToLength(cx, value, lengthp);
 }
 
+static MOZ_ALWAYS_INLINE bool BlazeSetLengthProperty(JSContext* cx,
+                                                     HandleObject obj,

anvbis

let buf = new ArrayBuffer(8);
let f64 = new Float64Array(buf);
let i32 = new Uint32Array(buf);
let i64 = new BigUint64Array(buf);

const ftoi = x => {
  f64[0] = x;
  return i64[0];
};

anvbis

var buf = new ArrayBuffer(8);
var f64 = new Float64Array(buf);
var i64 = new BigUint64Array(buf);

const ftoi = x => {
  f64[0] = x;
  return i64[0];
};

const itof = x => {