> wouldn’t the V8 example code be just as safe as the equivalent JS if it used the JS array’s own semantics? Yes, but imagine that the code we are talking abou

> wouldn’t the V8 example code be just as safe as the equivalent JS if it used the JS array’s own semantics? Yes, but imagine that the code we are talking about here is JIT code that the compiler emitted. If the compiler JITed code that was safe Rust then it could be safe. But JITs emit machine code and a big part of their performance is exactly in the "dangerous" areas like removing unneeded bounds checks. Say you have a bounds check in a loop. In some cases a JIT can remove it, if it can prove it's the same check in each iteration. Never removing the check would be safer, of course, but also slower. The point of the article here is that a lower-level sandboxing technique can help such JIT code: even if a pass has a logic bug (a bug Rust would not help with) and removes a necessary check then the sandboxing limits what can be exploited.