Assigning to jochen for investigation/triage. Thanks. :)

I don't see what's supposedly wrong here; perhaps I'm misreading the example. At least the "exploit file" doesn't contain anything obviously wrong.

window.window.__proto__.__proto__.__proto__.__proto__.constructor is simply Object. If you call that with a primitive value, it converts it to an object as required by the spec. Hence it creates a native-context specific object wrapper. For strings this is a string wrapper, for numbers a number wrapper. That's why typeof x and typeof y is "object". [[PrimitiveValue]] is simply V8 internal naming for [[StringData]], [[NumberData]] etc in the spec (see http://www.ecma-international.org/ecma-262/6.0/#sec-toobject).

Also the values aren't arbitrary? They are exactly what you passed in? I guess you might be confused by how DevTools renders the string object with all characters separately?

I wonder however why devtools exposes [[PrimitiveValue]] instead of the correct name of the internal slot as shown in the spec

Primarily curious about [[PrimitiveValue]] as well, was wondering whether in combination with a Debugger/Memory Mapping useful for Use-After-Free etc.

I was afraid that you might say "It's just Object". Shit happens. 

[[PrimitiveValue]] is just the ES5 naming for those internal slots actually. See e.g., https://es5.github.io/x15.7.html. We should probably update that to the new names.

I guess this part has to change a bit: https://cs.chromium.org/chromium/src/v8/src/runtime/runtime-debug.cc?type=cs&q=PrimitiveValue+package:%5Echromium$&l=287