> Microsoft's Javascript JIT engine This is Google's. The problem manifested in Chrome. From the article: > It turns out that v8 (Chrome’s JavaScript engine)

> Microsoft's Javascript JIT engine This is Google's. The problem manifested in Chrome. From the article: > It turns out that v8 (Chrome’s JavaScript engine) has CodeRange objects for managing code-gen [...] But what if you have multiple CodeRange objects, and what if those get allocated at random addresses and then freed?