News for hackers. Stuff that matters.

A comment on Exploiting Chrome V8: Krautflare.

Re:Exploiting Chrome V8: Krautflare by saagarjha on Thursday January 17, 2019 @02:41PM (#18933867)
Really interesting bug in TurboFan's optimizer; getting Math.expm1 handling -0 incorrectly to removing bounds checks by dancing around multiple optimization passes was quite illuminating. Although, later in the exploit, it seems like using WebAssembly creates a RWX page? Why is Chrome doing this for WebAssembly when it stopped doing this for JavaScript, for obvious reasons?
[ Parent | on HN ]
Re:Exploiting Chrome V8: Krautflare by kentonv on Thursday January 17, 2019 @03:56PM (#18934564)
V8 WebAssembly TLM Ben Titzer explained in a previous HN comment: https://news.ycombinator.com/item?id=18812449
[ Parent | on HN ]