(CVE-2024-5158)[338908243][$10000][builtins]The HasOnlySimpleElements function could incorrectly assume that certain non-JSObjects have simple elements -> ... -> Type Confusion
chromium-review.googlesource…@Kipreyyy
Day 3,
Working on my first project, that's an appointment booking app with JS objects, hasn't been easy though
Still working on it.
#100DaysOfCode#javascript#JSObjects
I love that there is nothing to stop you from crafting fake JSObjects in reader, unlike WebKit which at least attempts to stop attackers faking objects with randomized StructureID’s.
Objects and arrays are stored in JSObjects.
Objects are stored using named properties, { prp: 900 }.
Arrays using indexed properties, [90,60,50] or { 1:90, 2:60, 3:50 } .
v8.dev/blog/fast-properties