[CVE-2018-8177] Edge - Speculative type confusion on PropertyString

sethbrenith · MSLaguana · commit eb4b00bcd61a · 2018-05-08T11:17:36.000-07:00
Re-order PropertyString poisoning code
diff --git a/lib/Backend/Lower.cpp b/lib/Backend/Lower.cpp
@@ -15260,13 +15260,14 @@ Lowerer::GenerateFastElemIStringIndexCommon(IR::Instr * instrInsert, bool isStor
         IR::IndirOpnd::New(indexOpnd, 0, TyMachPtr, m_func),
         LoadVTableValueOpnd(instrInsert, VTableValue::VtablePropertyString),
         Js::OpCode::BrNeq_A, notPropStrLabel, instrInsert);
-    InsertBranch(Js::OpCode::Br, propStrLoadedLabel, instrInsert);
 
     if (!isStore)
     {
         InsertObjectPoison(indexOpnd, branchInstr, instrInsert);
     }
 
+    InsertBranch(Js::OpCode::Br, propStrLoadedLabel, instrInsert);
+
     instrInsert->InsertBefore(notPropStrLabel);
 
     branchInstr = InsertCompareBranch(

Original file line number	Diff line number	Diff line change
`@@ -15260,13 +15260,14 @@ Lowerer::GenerateFastElemIStringIndexCommon(IR::Instr * instrInsert, bool isStor`
`15260`	`15260`	`IR::IndirOpnd::New(indexOpnd, 0, TyMachPtr, m_func),`
`15261`	`15261`	`LoadVTableValueOpnd(instrInsert, VTableValue::VtablePropertyString),`
`15262`	`15262`	`Js::OpCode::BrNeq_A, notPropStrLabel, instrInsert);`
`15263`		`- InsertBranch(Js::OpCode::Br, propStrLoadedLabel, instrInsert);`
`15264`	`15263`
`15265`	`15264`	`if (!isStore)`
`15266`	`15265`	`{`
`15267`	`15266`	`InsertObjectPoison(indexOpnd, branchInstr, instrInsert);`
`15268`	`15267`	`}`
`15269`	`15268`
	`15269`	`+ InsertBranch(Js::OpCode::Br, propStrLoadedLabel, instrInsert);`
	`15270`	`+`
`15270`	`15271`	`instrInsert->InsertBefore(notPropStrLabel);`
`15271`	`15272`
`15272`	`15273`	`branchInstr = InsertCompareBranch(`