The Mysterious Realm of JavaScriptCore (2021)

https://www.cyberark.com/resources/threat-research-blog/the-mysterious-realm-of-javascriptcore

by program • 8 months ago

35 6 8 months ago

epolanski• 8 months ago

I've often thought about the possibility of implementing a language that can compile directly to optimized byte code (either for V8 or JSC), in order to get "hot code" that does not need runtime optimization, has anybody explored this idea?

pizlonator2• 8 months ago

That won't work for JS because you need runtime profiling to be able to do any meaningful optimizations

astrange• 7 months ago

That's WebAssembly / asm.js. Well, that's the target, you could still design a language for it.

gsf_emergency_6• 8 months ago

Author's talk from around that time (Apr 2021)

https://youtu.be/7qyKZOjhg94

[Finding] JS bugs in JSC with CodeQL

N_Lens• 8 months ago

Author used CodeQL to rediscover a CVE in JSC that was exploited by Pwn2Own in 2018. Very interesting. I guess now with increasing automation we'll see more CVE discovery through such tools.

pizlonator2• 8 months ago

A lot more details here: https://webkit.org/blog/10308/speculation-in-javascriptcore/

The Mysterious Realm of JavaScriptCore (2021)

Related Stories