[CVE-2020-0768]

lib/Backend/IRBuilder.cpp

@@ -1906,6 +1906,10 @@ IRBuilder::BuildReg2(Js::OpCode newOpcode, uint32 offset, Js::RegSlot R0, Js::Re
         this->AddInstr(instr, offset);
         return;
     }
+    case Js::OpCode::InitConst:
+        // Don't use InitConst in the JIT, as some dataflow tracking is missing, and we don't currently optimize for it.
+        newOpcode = Js::OpCode::Ld_A;
+        break;
     }
 
     IR::RegOpnd *   dstOpnd = this->BuildDstOpnd(R0);