Microsoft Edge Chakra JIT Bounce Check Elimination Bug

Microsoft Edge: Chakra: JIT: A bound check elimination bug CVE-2018-0980 Chakra uses the InvariantBlockBackwardIterator class to backpropagate the information about the hoisted bound checks. But the class follows the linked list instaed of the control flow. This may lead to incorrectly remove the...