Skip to content
Permalink
Browse files

[CVE-2019-0922] Type confusion in Edge - Individual

  • Loading branch information...
meg-gupta authored and MikeHolman committed Apr 12, 2019
1 parent ea04913 commit a9ab1aae31078e80593b9227db11d316c2239ef3
Showing with 8 additions and 1 deletion.
  1. +8 −1 lib/Backend/GlobOptArrays.cpp
@@ -1736,7 +1736,14 @@ void GlobOpt::ArraySrcOpt::Optimize()
{
if (newBaseValueType != baseValueType)
{
UpdateValue(nullptr, nullptr, nullptr);
if (globOpt->IsSafeToTransferInPrePass(baseOpnd, baseValue))
{
UpdateValue(nullptr, nullptr, nullptr);
}
else if (globOpt->IsOperationThatLikelyKillsJsArraysWithNoMissingValues(instr) && baseValueInfo->HasNoMissingValues())
{
globOpt->ChangeValueType(nullptr, baseValue, baseValueInfo->Type().SetHasNoMissingValues(false), true);
}
}

// For javascript arrays and objects with javascript arrays:

0 comments on commit a9ab1aa

Please sign in to comment.
You can’t perform that action at this time.