Microsoft Edge Eval Type Confusion
Posted by deepcore on November 18, 2016 – 3:04 am
In Chakra, function calls can sometimes take an extra internal argument, using the flag CallFlags_ExtraArg. The global eval function makes assumptions about the type of this extra arg, and casts it to a FrameDisplay object. If eval is called from a location in code where an extra parameter is added, for example, a Proxy function trap, and the extra parameter is of a different type, this can lead to type confusion.
Post a reply
You must be logged in to post a comment.