 Michael Ferris
|
b85f27cd3d
Fix line endings on a baseline
|
vor 8 Jahren |
 Jimmy Thomson
|
359cca5ec4
[MERGE #3349 @MSLaguana] Update version number to 1.5.3
|
vor 8 Jahren |
|
Jimmy Thomson
|
7be8d526f7
Update version number to 1.5.3
|
vor 8 Jahren |
 Akrosh Gandhi
|
bd1dba2da8
[MERGE #3341 @akroshg] 17-07 ChakraCore servicing release
|
vor 8 Jahren |
|
Akrosh Gandhi
|
9940903b29
excluded params.js to run on xplat
|
vor 8 Jahren |
|
Akrosh Gandhi
|
8ffc999222
Fix arm prefast failure
|
vor 8 Jahren |
|
Akrosh Gandhi
|
1f3a3f4e6b
Fixing prefast warning and copyright header error
|
vor 8 Jahren |
|
Michael Ferris
|
8fafa37204
[CVE-2017-8603] Change how we handle return value for asm.js/wasm interpreter
|
vor 8 Jahren |
|
Michael Ferris
|
6999714882
[CVE-2017-8604] Fix for stack allocation for asm.js/wasm
|
vor 8 Jahren |
 Paul Leathers
|
2e514d7265
[CVE-2017-8609] On object pointer copy prop, check for mismatch between new pointer symbol and existing object type spec info. If there is a mismatch, then stale ObjTypeSpecFldInfo may lead to jitted code that accesses a bad address, so disable optimization of this load/store.
|
vor 8 Jahren |
|
Paul Leathers
|
9326bda18a
[CVE-2017-8601] Generate bailouts for cases of typed array stores where conversion of the source value can cause implicit calls. For BailOutOnImplicitCalls, check implicit call bit on return from the conversion helper. For BailOutOnArrayAccessHelperCall, bail out instead of calling the conversion helper.
|
vor 8 Jahren |
 Suwei Chen
|
39155400a7
[CVE-2017-8598] Uninitialized 'this' register
|
vor 8 Jahren |
 Rajat Dua
|
f9795364cb
[CVE-2017-8610] Prevent loading bad function object for inlinees
|
vor 8 Jahren |
 Jianchun Xu
|
e40a34fad7
[CVE-2017-8607] DictionaryTypeHandler property descriptor may contain invalid index
|
vor 8 Jahren |
|
Jianchun Xu
|
7c3214efc8
[CVE-2017-8606, CVE-2017-8608] DictionaryTypeHandler nextPropertyIndex++ overflow
|
vor 8 Jahren |
|
Akrosh Gandhi
|
f780a1157f
[CVE-2017-8619] Put failfast error on the OOM exception on certain places in the array APIs
|
vor 8 Jahren |
 Oguz Bastemur
|
5d9535ac77
[MERGE #3190 @obastemur] xplat: fix ICU lib tilde path problem
|
vor 8 Jahren |
|
Oguz Bastemur
|
d819d249e3
xplat: fix ICU lib tilde path problem
|
vor 8 Jahren |
|
Jimmy Thomson
|
f91c91297d
[MERGE #3051 @MSLaguana] Updating release notes link
|
vor 8 Jahren |
|
Jimmy Thomson
|
ccbc1ea527
Updating release notes link
|
vor 8 Jahren |
|
Jianchun Xu
|
93ec291cff
[MERGE #3166 @jianchun] 17-06 ChakraCore servicing release
|
vor 8 Jahren |
|
Jianchun Xu
|
86b66eefa6
fix some 17-06 build breaks and CI copyright check failure
|
vor 8 Jahren |
 Meghana Gupta
|
bb95963a4a
[CVE-2017-8499] Fix expanding rest arguments during inlining
|
vor 8 Jahren |
|
Rajat Dua
|
320547aabe
[CVE-2017-0228] Reallocate the last segment of a sparse array as a non-leaf, if necessary, before attempting to reverse the segment linked list
|
vor 8 Jahren |
 Michael Holman
|
dd3e73bfec
[CVE-2017-8520] ensure that ServerScriptContext is unregistered before freeing
|
vor 8 Jahren |
|
Paul Leathers
|
cd60f3b5c3
[CVE-2017-8548] In the case of a write to a typed array, the JIT emits inline code to do a bounds check. If the check fails, we convert the source value and jump to the end of the operation. But if the store should bail out on implicit calls, then we need to check for implicit calls caused by the conversion as well as the store itself.
|
vor 8 Jahren |
|
Paul Leathers
|
b4f28f09d1
[CVE-2017-8524] Force addition of a data slot to the property descriptor when a global let/const property is added and a same-named global getter/setter already exists.
|
vor 8 Jahren |
|
Paul Leathers
|
886a64c39c
[CVE-2017-8518] Use protected add operations when computing the length of a new frame display.
|
vor 8 Jahren |
|
Jianchun Xu
|
8dc4469e4d
[CVE-2017-8522] TypeHandler invalid index reuse may cause buffer overrun
|
vor 8 Jahren |
|
Jimmy Thomson
|
b3ec4b6344
Update version number to 1.5.2
|
vor 8 Jahren |
