Microsoft Edge Chakra JIT Bounce Check Elimination Bug

Microsoft Edge: Chakra: JIT: A bound check elimination bug CVE-2018-0980 Chakra uses the InvariantBlockBackwardIterator class to backpropagate the information about the hoisted bound checks. But the class follows the linked list instaed of the control flow. This may lead to incorrectly remove the...

Microsoft Edge Chakra JIT - Bound Check Elimination Bug

Microsoft Edge Chakra JIT - Bound Check Elimination Bug / Chakra uses the InvariantBlockBackwardIterator class to backpropagate the information about the hoisted bound checks. But the class follows the linked list instaed of the control flow. This may lead to incorrectly remove the bound checks. ...

Microsoft Edge Chakra JIT - Bound Check Elimination Bug

/ Chakra uses the InvariantBlockBackwardIterator class to backpropagate the information about the hoisted bound checks. But the class follows the linked list instaed of the control flow. This may lead to incorrectly remove the bound checks. In the following code, currentBlock's block number is 4...