I appreciate the thorough explanation... you seem to understand the domain... but I still don't get how this would work in practice. My experience with C/C++ is somewhat limited but I imagine V8 does something like reserve a whole bunch of addresses and then manage them itself, with some internal list where script arrays/objects correspond to blocks. Or maybe it delegates some of that to C++ vectors that can scale up. But what scripted integer or array could you pass it that would access anything already freed or outside the bounds of the addresses that array was mapped to? The only thing I can think is some kind of asynchronous wipe that would allow the engine to write other data to that block, and using a race condition to access it after it was free. But that doesn't sound quite like a type confusion.
What's an actual snippet of pseudo-JS that could make the engine overrun its memory and start reading out of arbitrary addresses, even within the sandbox? Wouldn't that have been accounted for in the most basic design?
What's an actual snippet of pseudo-JS that could make the engine overrun its memory and start reading out of arbitrary addresses, even within the sandbox? Wouldn't that have been accounted for in the most basic design?