mistymntncop

#include <stdio.h>
#include <stdlib.h>
#include <stdint.h>
#include <stdbool.h>
#include <malloc.h>
#include <assert.h>

//Just pedagogical. No proper memory managagement here, would use Arenas in practice

enum {

mistymntncop

#include <stdio.h>
#include <stdlib.h>
#include <stdint.h>
#include <stdbool.h>
#include <malloc.h>
#include <assert.h>

//Just pedagogical. No proper memory managagement here, would use Arenas in practice

#define NODE_CHILD_COUNT 2

mistymntncop

#include <stdio.h>
#include <stdlib.h>
#include <stdint.h>
#include <stdbool.h>
#include <malloc.h>
#include <assert.h>

//Just pedagogical. No proper memory managagement here, would use Arenas in practice

#define NODE_CHILD_COUNT 2

mistymntncop

//Preconditons
//----------------------
// (1) The receiver must be a regular object and the key a unique name.
//        this excludes special objects such as globalThis, wasm object, etc
// (2) The property to be deleted must be the last property.
// (3) The property to be deleted must be deletable.
//        this excludes non-configurable properties. So no frozen or sealed objects.
// (4) The map must have a back pointer.
//        this excludes prototype maps
// (5) The last transition must have been caused by adding a property

mistymntncop

d8.file.execute("wasm-module-builder.js");

let builder = new WasmModuleBuilder();

let array_type = builder.addArray(kWasmI32, true);
builder.addFunction('create_array', makeSig([kWasmI32], [wasmRefType(array_type)]))
    .addBody([
        kExprLocalGet, 0,
        kGCPrefix, kExprArrayNewDefault, array_type,
    ])

mistymntncop

// Build d8 using:
// a) Run once
//    git checkout 6f98fbe86a0d11e6c902e2ee50f609db046daf71
//    gclient sync
//    gn gen ./out/x64.debug
//    gn gen ./out/x64.release
//
// b) 
//    Debug Build:
//    ninja -C ./out/x64.debug d8

mistymntncop

#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <stdbool.h>
#include <windows.h>

#include "nt_crap.h"

#define ArrayCount(arr) (sizeof(arr)/sizeof(arr[0]))
#define assert(expr) if(!(expr)) { *(char*)0 = 0; }

mistymntncop

<?php header("Status: 204"); ?>

mistymntncop

//v8 version 11.4.183.19
//git checkout 56e5481171da3eacd3cb83db2be3b2d2b96b4abb 
//MODIFY BUILD.gn in the root v8 folder to enable the memory corruption api
//v8_expose_memory_corruption_api = true
//ninja -C ./out/x64.debug d8   
//ninja -C ./out/x64.release d8


const addr_of = (o) => {
    return Sandbox.getAddressOf(o);

mistymntncop

test.js

var arr = new Array(1.1, 2.2, 3.3);
function test(obj) {
    arr[0] = obj;
}
test({});

Print bytecode of test function: