Files
pwn-learning/PwnCollege/V8Exploitation/Level7

Level 7

Problem

Patch deleted all Deoptimize calling for CheckMaps in Machine Lowering phase of TurboShaft, which means TurboFan generated JITed code won't bail out if object's map is wrong.

Key Knowledge