uUse a sequence of JavaScript allocations and free's to make the heap look like this: uAllocate vulnerable buffer in JavaScript and cause overflow slide 28 Placing Vulnerable Buffer [Safari PCRE exploit, 2008] object O free blocks heap
{}