//heapLib2 namespace

function heapLib2() { }

//These are attributes that will not actually create a bstr

//and directly use the back-end allocator, completely bypassing the cache

var global_attrs = ["title", "lang", "class"];

heapLib2.ie = function(element, maxAlloc)

{

//128mb

this.maxAlloc = 0x8000000;

//make sure that an HTML DOM element is passed

if(!element.nodeType || element.nodeType != 1)

throw "alloc.argument: element not valid";

this.element = element;

if(maxAlloc)

this.maxAlloc = maxAlloc;

//empty the cache

this.Oleaut32EmptyCache();

this.Oleaut32FillCache();

this.Oleaut32EmptyCache();

}

heapLib2.ie.prototype.newelement = function(element)

{

//make sure that an HTML DOM element is passed

if(!element.nodeType || element.nodeType != 1)

throw "alloc.argument: element not valid";

this.element = element;

}

heapLib2.ie.prototype.alloc = function(attr_name, size, cache_ok)

{

if(typeof(cache_ok)==='undefined')

cache_ok = false;

else

cache_ok = true;

//make sure the attribute name is a string

if(typeof attr_name != "string")

throw "alloc.argument: attr_name is not a string";

//make sure that the attribute name is not already present in the html element

if(this.element.getAttribute(attr_name))

throw "alloc.argument: element already contains attr_name: " + attr_name;

//ensure the size is a number

if(typeof size != "number")

throw "alloc.argument: size is not a number: " + size;

//make sure the size isn't one of the special values

if(!cache_ok && (size == 0x20 || size == 0x40 || size == 0x100 || size == 0x8000))

throw "alloc.argument: size cannot be flushed from cache: " + size;

if(size > this.maxAlloc)

throw "alloc.argument: size cannot be greater than maxAlloc(" + this.maxAlloc + ") : " + size;

//the size must be at a 16-byte boundary this can be commented out but

//the allocations will be rounded to the nearest 16-byte boundary

if(size % 16 != 0)

throw "alloc.argument: size be a multiple of 16: " + size;

//20-bytes will be added to the size

//<4-byte size><data><2-byte null>

size = ((size / 2) - 6);

//May have to change this due to allocation side effects

var data = new Array(size).join(cache_ok ? "C" : "$");

var attr = document.createAttribute(attr_name);

this.element.setAttributeNode(attr);

this.element.setAttribute(attr_name, data);

}

//These items will allocate/free memory and should really

//only be used once per element. You can use a new element

//by calling the 'newelement' method above

heapLib2.ie.prototype.alloc_nobstr = function(val)

{

//make sure the aval is a string

if(typeof val != "string")

throw "alloc.argument: val is not a string";

var size = (val.length * 2) + 6;

if(size > this.maxAlloc)

throw "alloc_nobstr.val: string length cannot be greater than maxAlloc(" + this.maxAlloc + ") : " + size;

var i = 0;

var set_gattr = 0;

for(i = 0; i < global_attrs.length; i++)

{

curr_gattr = global_attrs[i];

if(!this.element.getAttribute(curr_gattr))

{

this.element.setAttribute(curr_gattr, "");

this.element.setAttribute(curr_gattr, val);

set_gattr = 1;

break;

}

}

if(set_gattr == 0)

throw "alloc_nobstr: all global attributes are assigned, try a new element";

}

//completely bypass the cache, useful for heap spraying (see heapLib2_test.html)

heapLib2.ie.prototype.sprayalloc = function(attr_name, str)

{

//make sure the attribute name is a string

if(typeof attr_name != "string")

throw "alloc.argument: attr_name is not a string";

//make sure that the attribute name is not already present in the html element

if(this.element.getAttribute(attr_name))

throw "alloc.argument: element already contains attr_name: " + attr_name;

//ensure the size is a number

if(typeof str != "string")

throw "alloc.argument: str is not a string: " + typeof str;

var size = (str.length * 2) + 6;

//make sure the size isn't one of the special values

if(size <= 0x8000)

throw "alloc.argument: bigalloc must be greater than 0x8000: " + size;

if(size > this.maxAlloc)

throw "alloc.argument: size cannot be greater than maxAlloc(" + this.maxAlloc + ") : " + size;

var attr = document.createAttribute(attr_name);

this.element.setAttributeNode(attr);

this.element.setAttribute(attr_name, str);

}

heapLib2.ie.prototype.free = function(attr_name, skip_flush)

{

if(typeof(skip_flush)==='undefined')

skip_flush = false;

else

skip_flush = true;

//make sure that an HTML DOM element is passed

if(!this.element.nodeType || this.element.nodeType != 1)

throw "alloc.argument: element not valid";

//make sure the attribute name is a string

if(typeof attr_name != "string")

throw "alloc.argument: attr_name is not a string";

//make sure that the attribute name is not already present in the html element

if(!this.element.getAttribute(attr_name))

throw "alloc.argument: element does not contain attribute: " + attr_name;

//make sure the cache is full so the chunk returns the general purpose heap

if(!skip_flush)

this.Oleaut32FillCache();

this.element.setAttribute(attr_name, null);

if(!skip_flush)

this.Oleaut32EmptyCache()

}

heapLib2.ie.prototype.Oleaut32FillCache = function()

{

for(var i = 0; i < 6; i++)

{

this.free("cache0x20"+i, true);

this.free("cache0x40"+i, true);

this.free("cache0x100"+i, true);

this.free("cache0x8000"+i, true);

}

}

heapLib2.ie.prototype.Oleaut32EmptyCache = function()

{

for(var i = 0; i < 6; i++)

{

this.alloc("cache0x20"+i, 0x20, true);

this.alloc("cache0x40"+i, 0x40, true);

this.alloc("cache0x100"+i, 0x100, true);

this.alloc("cache0x8000"+i, 0x8000, true);

}

}