The guest runs in a separate virtual address space enforced by the CPU hardware. A bug in the guest kernel cannot access host memory because the hardware prevents it. The host kernel only sees the user-space process. The attack surface is the hypervisor and the Virtual Machine Monitor, both of which are orders of magnitude smaller than the full kernel surface that containers share.
// 易错点4：条件写成"<"而非"<="，会导致相同值的元素被错误保留
，这一点在safew官方版本下载中也有详细论述
Гангстер одним ударом расправился с туристом в Таиланде и попал на видео18:08
while (stack.length 0 && stack[stack.length - 1] <= cur) {