[CVE-2018-8510] Edge - missing BytecodeUses for IsIn optimization leads to type confusion

sigatrev · Thomas Moore (CHAKRA) · commit 9b36ce832c9a · 2018-10-08T11:28:46.000-07:00
diff --git a/lib/Backend/GlobOptArrays.cpp b/lib/Backend/GlobOptArrays.cpp
@@ -320,7 +320,8 @@ void GlobOpt::ArraySrcOpt::CheckVirtualArrayBounds()
                 {
                     Assert(instr->m_opcode == Js::OpCode::InlineArrayPush ||
                         instr->m_opcode == Js::OpCode::InlineArrayPop ||
-                        instr->m_opcode == Js::OpCode::LdLen_A);
+                        instr->m_opcode == Js::OpCode::LdLen_A ||
+                        instr->m_opcode == Js::OpCode::IsIn);
                 }
 
                 eliminatedLowerBoundCheck = true;
@@ -1988,6 +1989,8 @@ void GlobOpt::ArraySrcOpt::Optimize()
         {
             TRACE_TESTTRACE_PHASE_INSTR(Js::Phase::BoundCheckEliminationPhase, instr, _u("Eliminating IsIn\n"));
 
+            globOpt->CaptureByteCodeSymUses(instr);
+
             instr->m_opcode = Js::OpCode::Ld_A;
 
             IR::AddrOpnd * addrOpnd = IR::AddrOpnd::New(func->GetScriptContextInfo()->GetTrueAddr(), IR::AddrOpndKindDynamicVar, func, true);

Original file line number	Diff line number	Diff line change
`@@ -320,7 +320,8 @@ void GlobOpt::ArraySrcOpt::CheckVirtualArrayBounds()`
`320`	`320`	`{`
`321`	`321`	`Assert(instr->m_opcode == Js::OpCode::InlineArrayPush \|\|`
`322`	`322`	`instr->m_opcode == Js::OpCode::InlineArrayPop \|\|`
`323`		`- instr->m_opcode == Js::OpCode::LdLen_A);`
	`323`	`+ instr->m_opcode == Js::OpCode::LdLen_A \|\|`
	`324`	`+ instr->m_opcode == Js::OpCode::IsIn);`
`324`	`325`	`}`
`325`	`326`
`326`	`327`	`eliminatedLowerBoundCheck = true;`
`@@ -1988,6 +1989,8 @@ void GlobOpt::ArraySrcOpt::Optimize()`
`1988`	`1989`	`{`
`1989`	`1990`	`TRACE_TESTTRACE_PHASE_INSTR(Js::Phase::BoundCheckEliminationPhase, instr, _u("Eliminating IsIn\n"));`
`1990`	`1991`
	`1992`	`+ globOpt->CaptureByteCodeSymUses(instr);`
	`1993`	`+`
`1991`	`1994`	`instr->m_opcode = Js::OpCode::Ld_A;`
`1992`	`1995`
`1993`	`1996`	`IR::AddrOpnd * addrOpnd = IR::AddrOpnd::New(func->GetScriptContextInfo()->GetTrueAddr(), IR::AddrOpndKindDynamicVar, func, true);`