 Michael Ferris
|
b85f27cd3d
Fix line endings on a baseline
|
8 years ago |
 Jimmy Thomson
|
359cca5ec4
[MERGE #3349 @MSLaguana] Update version number to 1.5.3
|
8 years ago |
|
Jimmy Thomson
|
7be8d526f7
Update version number to 1.5.3
|
8 years ago |
 Akrosh Gandhi
|
bd1dba2da8
[MERGE #3341 @akroshg] 17-07 ChakraCore servicing release
|
8 years ago |
|
Akrosh Gandhi
|
9940903b29
excluded params.js to run on xplat
|
8 years ago |
|
Akrosh Gandhi
|
8ffc999222
Fix arm prefast failure
|
8 years ago |
|
Akrosh Gandhi
|
1f3a3f4e6b
Fixing prefast warning and copyright header error
|
8 years ago |
|
Michael Ferris
|
8fafa37204
[CVE-2017-8603] Change how we handle return value for asm.js/wasm interpreter
|
8 years ago |
|
Michael Ferris
|
6999714882
[CVE-2017-8604] Fix for stack allocation for asm.js/wasm
|
8 years ago |
 Paul Leathers
|
2e514d7265
[CVE-2017-8609] On object pointer copy prop, check for mismatch between new pointer symbol and existing object type spec info. If there is a mismatch, then stale ObjTypeSpecFldInfo may lead to jitted code that accesses a bad address, so disable optimization of this load/store.
|
8 years ago |
|
Paul Leathers
|
9326bda18a
[CVE-2017-8601] Generate bailouts for cases of typed array stores where conversion of the source value can cause implicit calls. For BailOutOnImplicitCalls, check implicit call bit on return from the conversion helper. For BailOutOnArrayAccessHelperCall, bail out instead of calling the conversion helper.
|
8 years ago |
 Suwei Chen
|
39155400a7
[CVE-2017-8598] Uninitialized 'this' register
|
8 years ago |
 Rajat Dua
|
f9795364cb
[CVE-2017-8610] Prevent loading bad function object for inlinees
|
8 years ago |
 Jianchun Xu
|
e40a34fad7
[CVE-2017-8607] DictionaryTypeHandler property descriptor may contain invalid index
|
8 years ago |
|
Jianchun Xu
|
7c3214efc8
[CVE-2017-8606, CVE-2017-8608] DictionaryTypeHandler nextPropertyIndex++ overflow
|
8 years ago |
|
Akrosh Gandhi
|
f780a1157f
[CVE-2017-8619] Put failfast error on the OOM exception on certain places in the array APIs
|
8 years ago |
 Oguz Bastemur
|
5d9535ac77
[MERGE #3190 @obastemur] xplat: fix ICU lib tilde path problem
|
8 years ago |
|
Oguz Bastemur
|
d819d249e3
xplat: fix ICU lib tilde path problem
|
8 years ago |
|
Jimmy Thomson
|
f91c91297d
[MERGE #3051 @MSLaguana] Updating release notes link
|
8 years ago |
|
Jimmy Thomson
|
ccbc1ea527
Updating release notes link
|
8 years ago |
|
Jianchun Xu
|
93ec291cff
[MERGE #3166 @jianchun] 17-06 ChakraCore servicing release
|
8 years ago |
|
Jianchun Xu
|
86b66eefa6
fix some 17-06 build breaks and CI copyright check failure
|
8 years ago |
 Meghana Gupta
|
bb95963a4a
[CVE-2017-8499] Fix expanding rest arguments during inlining
|
8 years ago |
|
Rajat Dua
|
320547aabe
[CVE-2017-0228] Reallocate the last segment of a sparse array as a non-leaf, if necessary, before attempting to reverse the segment linked list
|
8 years ago |
 Michael Holman
|
dd3e73bfec
[CVE-2017-8520] ensure that ServerScriptContext is unregistered before freeing
|
8 years ago |
|
Paul Leathers
|
cd60f3b5c3
[CVE-2017-8548] In the case of a write to a typed array, the JIT emits inline code to do a bounds check. If the check fails, we convert the source value and jump to the end of the operation. But if the store should bail out on implicit calls, then we need to check for implicit calls caused by the conversion as well as the store itself.
|
8 years ago |
|
Paul Leathers
|
b4f28f09d1
[CVE-2017-8524] Force addition of a data slot to the property descriptor when a global let/const property is added and a same-named global getter/setter already exists.
|
8 years ago |
|
Paul Leathers
|
886a64c39c
[CVE-2017-8518] Use protected add operations when computing the length of a new frame display.
|
8 years ago |
|
Jianchun Xu
|
8dc4469e4d
[CVE-2017-8522] TypeHandler invalid index reuse may cause buffer overrun
|
8 years ago |
|
Jimmy Thomson
|
b3ec4b6344
Update version number to 1.5.2
|
8 years ago |
