Subscribe via feed.

Microsoft Edge Chakra JIT Bounce Check Elimination Bug

Posted by deepcore on May 19, 2018 – 12:44 pm

Chakra uses the InvariantBlockBackwardIterator class to backpropagate the information about the hoisted bound checks. But the class follows the linked list instead of the control flow. This may lead to incorrectly remove the bound checks.


This post is under “exploit” and has no respond so far.
If you enjoy this article, make sure you subscribe to my RSS Feed.

Post a reply

You must be logged in to post a comment.


« »