90245c7091
1. The threshold to trigger MAGLEV compilation is different when gdb is attached to d8 or not.
- When gdb attached to d8, the training loop count to trigger MAGLEV is 100,000.
- But when the standalone d8 running, the training loop count to trigger MAGLEV is only 10,000. If you still use 100,000, it will trigger TURBOFAN then code data structure will change and shellcode execution fails.
2. Fixed other miscellaneous minor mistakes.
Level 3
Problem
Given the following primitves:
- AddressOf
- FakeObject
Key Knowledge
- Fast properties in V8
- Static Roots: Objects with Compile-Time Constant Addresses
- Use AddressOf & FakeObject to Construct Arbitrary Address Read & Write
- Know V8 Heap Fengshui by using native syntax