[CVE-2020-0768]

boingoing · pleath · commit a0e8946f39d8 · 2020-03-06T15:53:19.000-08:00
diff --git a/lib/Backend/IRBuilder.cpp b/lib/Backend/IRBuilder.cpp
@@ -1906,6 +1906,10 @@ IRBuilder::BuildReg2(Js::OpCode newOpcode, uint32 offset, Js::RegSlot R0, Js::Re
         this->AddInstr(instr, offset);
         return;
     }
+    case Js::OpCode::InitConst:
+        // Don't use InitConst in the JIT, as some dataflow tracking is missing, and we don't currently optimize for it.
+        newOpcode = Js::OpCode::Ld_A;
+        break;
     }
 
     IR::RegOpnd *   dstOpnd = this->BuildDstOpnd(R0);

Original file line number	Diff line number	Diff line change
`@@ -1906,6 +1906,10 @@ IRBuilder::BuildReg2(Js::OpCode newOpcode, uint32 offset, Js::RegSlot R0, Js::Re`
`1906`	`1906`	`this->AddInstr(instr, offset);`
`1907`	`1907`	`return;`
`1908`	`1908`	`}`
	`1909`	`+ case Js::OpCode::InitConst:`
	`1910`	`+ // Don't use InitConst in the JIT, as some dataflow tracking is missing, and we don't currently optimize for it.`
	`1911`	`+ newOpcode = Js::OpCode::Ld_A;`
	`1912`	`+ break;`
`1909`	`1913`	`}`
`1910`	`1914`
`1911`	`1915`	`IR::RegOpnd * dstOpnd = this->BuildDstOpnd(R0);`