WebKit JIT - Int32Double Arrays can have Proxy Objects in the Prototype Chains

WebKit JIT - Int32Double Arrays can have Proxy Objects in the Prototype Chains didBecomePrototype; if structurevm-hasMonoProto DeferredStructureTransitionWatchpointFire deferredvm, structurevm; Structure newStructure = Structure::changePrototypeTransitionvm, structurevm, prototype, deferred;...

WebKit JSC - arrayProtoFuncSplice does not Initialize all Indices Exploit

Exploit for multiple platform in category dos / poc lexicalGlobalObject-arrayStructureForIndexingTypeDuringAllocationArrayWithUndecided, actualDeleteCount; if !result return JSValue::encodethrowOutOfMemoryErrorexec, scope; for unsigned k = 0; k initializeIndexvm, k, v;...

WebKit JSC - arrayProtoFuncSplice does not Initialize all Indices

WebKit JSC - arrayProtoFuncSplice does not Initialize all Indices lexicalGlobalObject-arrayStructureForIndexingTypeDuringAllocationArrayWithUndecided, actualDeleteCount; if !result return JSValue::encodethrowOutOfMemoryErrorexec, scope; for unsigned k = 0; k initializeIndexvm, k, v;...

WebKit JSC - JSGlobalObject::haveABadTime Causes Type Confusions

WebKit JSC - JSGlobalObject::haveABadTime Causes Type Confusions switchToSlowPutArrayStoragevm; = MINSPARSEARRAYINDEX || structurevm-holesMustForwardToPrototypevm return nullptr; Structure resultStructure = exec.l...

WebKit JSC - JSGlobalObject::haveABadTime Causes Type Confusions

switchToSlowPutArrayStoragevm; = MINSPARSEARRAYINDEX || structurevm-holesMustForwardToPrototypevm return nullptr; Structure resultStructure = exec.lexicalGlobalObject-arrayStructureForIndexingTypeDuringAllocati...

WebKit JSC JSGlobalObject::haveABadTime Type Confusion

WebKit: JSC: JSGlobalObject::haveABadTime causes type confusions CVE-2017-7005 After JSGlobalObject::haveABadTime is called, the type of all JavaScript arraysincluding newly created arrays are of the same type: ArrayWithSlowPutArrayStorage. But of course this only affects objects that share the...