[CVE-2019-1217]

chakra-core · Sep 9, 2019 · b75847e · b75847e
1 parent c5297b8
commit b75847e
Show file tree

Hide file tree

Showing 8 changed files with 10,789 additions and 12,183 deletions.
diff --git a/lib/Runtime/ByteCode/ByteCodeCacheReleaseFileVersion.h b/lib/Runtime/ByteCode/ByteCodeCacheReleaseFileVersion.h
@@ -5,6 +5,6 @@
 // NOTE: If there is a merge conflict the correct fix is to make a new GUID.
 // This file was generated with tools\update_bytecode_version.ps1
 
-// {3096A219-129D-4A4A-A61C-186D03BB25B7}
+// {81AEEA4B-AE4E-40C0-848F-6DB7C5F49F55}
 const GUID byteCodeCacheReleaseFileVersion =
-{ 0x3096a219, 0x129d, 0x4a4a, { 0xa6, 0x1c, 0x18, 0x6d, 0x3, 0xbb, 0x25, 0xb7 } };
+{ 0x81AEEA4B, 0xAE4E, 0x40C0, { 0x84, 0x8F, 0x6D, 0xB7, 0xC5, 0xF4, 0x9F, 0x55 } };
diff --git a/lib/Runtime/Library/InJavascript/Intl.js.bc.32b.h b/lib/Runtime/Library/InJavascript/Intl.js.bc.32b.h
diff --git a/lib/Runtime/Library/InJavascript/Intl.js.bc.64b.h b/lib/Runtime/Library/InJavascript/Intl.js.bc.64b.h
diff --git a/lib/Runtime/Library/JsBuiltIn/JsBuiltIn.js b/lib/Runtime/Library/JsBuiltIn/JsBuiltIn.js
@@ -8,19 +8,19 @@
 (function (intrinsic) {
     var platform = intrinsic.JsBuiltIn;
 
-    let FunctionsEnum = {
-        ArrayValues: { className: "Array", methodName: "values", argumentsCount: 0, forceInline: true /*optional*/, alias: "Symbol.iterator" },
-        ArrayKeys: { className: "Array", methodName: "keys", argumentsCount: 0, forceInline: true /*optional*/ },
-        ArrayEntries: { className: "Array", methodName: "entries", argumentsCount: 0, forceInline: true /*optional*/ },
-        ArrayIndexOf: { className: "Array", methodName: "indexOf", argumentsCount: 1, forceInline: true /*optional*/ },
-        ArrayFilter: { className: "Array", methodName: "filter", argumentsCount: 1, forceInline: true /*optional*/ },
-    };
-
     var setPrototype = platform.builtInSetPrototype;
     var _objectDefineProperty = platform.builtInJavascriptObjectEntryDefineProperty;
     var Symbol = platform.Symbol;
     var CreateObject = platform.builtInJavascriptObjectCreate;
 
+    let FunctionsEnum = {
+        ArrayValues: setPrototype({ className: "Array", methodName: "values", argumentsCount: 0, forceInline: true /*optional*/, alias: "Symbol.iterator" }, null),
+        ArrayKeys: setPrototype({ className: "Array", methodName: "keys", argumentsCount: 0, forceInline: true /*optional*/ }, null),
+        ArrayEntries: setPrototype({ className: "Array", methodName: "entries", argumentsCount: 0, forceInline: true /*optional*/ }, null),
+        ArrayIndexOf: setPrototype({ className: "Array", methodName: "indexOf", argumentsCount: 1, forceInline: true /*optional*/ }, null),
+        ArrayFilter: setPrototype({ className: "Array", methodName: "filter", argumentsCount: 1, forceInline: true /*optional*/ }, null),
+    };
+
     platform.registerChakraLibraryFunction("ArrayIterator", function (arrayObj, iterationKind) {
         "use strict";
         __chakraLibrary.InitInternalProperties(this, 4, "__$arrayObj$__", "__$nextIndex$__", "__$kind$__", "__$internalDone$__");

diff --git a/lib/Runtime/Library/JsBuiltIn/JsBuiltIn.js.bc.32b.h b/lib/Runtime/Library/JsBuiltIn/JsBuiltIn.js.bc.32b.h
diff --git a/lib/Runtime/Library/JsBuiltIn/JsBuiltIn.js.bc.64b.h b/lib/Runtime/Library/JsBuiltIn/JsBuiltIn.js.bc.64b.h
diff --git a/lib/Runtime/Library/JsBuiltIn/JsBuiltIn.js.nojit.bc.32b.h b/lib/Runtime/Library/JsBuiltIn/JsBuiltIn.js.nojit.bc.32b.h
diff --git a/lib/Runtime/Library/JsBuiltIn/JsBuiltIn.js.nojit.bc.64b.h b/lib/Runtime/Library/JsBuiltIn/JsBuiltIn.js.nojit.bc.64b.h