Subscribe via feed.

Microsoft Edge Chakra JIT Failed RegexHelper::StringReplace Call

Posted by deepcore on October 15, 2017 – 2:33 pm

The “String.prototype.replace” method can be inlined in the JIT process. So in the method, all the calls which may break the JIT assumptions must be invoked with updating “ImplicitCallFlags”. But “RegexHelper::StringReplace” calls the replace function without updating the flag. Therefore it fails to detect if a user function was called.


This post is under “exploit” and has no respond so far.
If you enjoy this article, make sure you subscribe to my RSS Feed.

Post a reply

You must be logged in to post a comment.