Use-after-free in Mozilla JavaScript Engine

Repository contains a minimal JavaScript engine exploit PoC with 3 files: (1) README.md provides a detailed root-cause and exploitation strategy for a for-in iterator lifetime bug involving generators/yield and GC, leading to a use-after-free in iterator bookkeeping during property deletion; it further explains how the resulting primitive is a constrained 1-bit write at an attacker-influenced (8-byte aligned) address via NativeIterator cursor->markDeleted(), and proposes targeting MallocArena-allocated ImmutableScriptData (bytecode storage) to flip a bit in the bytecode stream used by JSOp::InitElemArray, allowing corruption of an array’s initialized length beyond capacity and enabling OOB read/write. (2) poc.html simply includes poc.js. (3) poc.js implements the trigger: it builds many candidate functions via eval (fff[]) to influence bytecode layout, defines a gc() routine that allocates many ArrayBuffers to force garbage collection, and uses a Proxy with getPrototypeOf trap to run gc() and execute fff[] during for-in iteration. The exploit creates an object with many properties to shape NativeIterator size, iterates it inside a generator (yield), calls f(o).next() without keeping a strong reference to the generator, then deletes a property (delete o["A11"]) to invoke the iterator suppression path while the iterator may have been freed by GC, aiming to obtain the 1-bit write. It then searches for which generated function produced a corrupted array (arrr) and demonstrates OOB by printing arrr.length and reading arrr[i] for i up to 0x20. No network IOCs/endpoints are present; the only observable endpoints are the local files used to load/run the PoC.