Intro to Chrome’s V8 from an exploit development angle

This blog post walks through V8 internals—Ignition, TurboFan, and the Turbolizer tool—showing how JIT speculative optimizations can lead to type-confusion and bounds-check elimination exploits. It includes example code, d8 trace flags, Turbolizer visualizations, and a gdb debugging session, and notes recent V8 hardenings that mitigate the demonstrated bounds-check removal vectors.