Microsoft Edge Array.reverse Overflow
Posted by deepcore on November 19, 2016 – 3:14 am
There is an overflow when reversing arrays in Chakra. On line 5112 of JavascriptArray::EntryReverse, the length of the array is fetched and stored. It is then passed as a parameter into JavascriptArray::ReverseHelper, which then calls FillFromPrototypes, which can change the size of the array.
Post a reply
You must be logged in to post a comment.