Reliability results for exploit.js:
  release d8: 50/50 successful, exit 0, success marker present
  ASAN d8:    20/20 successful, exit 0, success marker present

Release command:
  out/triage-release/d8 --allow-natives-syntax --maglev --no-turbofan --no-debug-code exploit.js

ASAN command:
  ASAN_OPTIONS=detect_leaks=0:abort_on_error=1 out/triage-asan/d8 --allow-natives-syntax --maglev --no-turbofan --no-debug-code exploit.js

The compressed static-root values and carrier/backing adjacency were stable in every fresh process.
