 Michael Ferris
|
b85f27cd3d
Fix line endings on a baseline
|
8 лет назад |
 Jimmy Thomson
|
359cca5ec4
[MERGE #3349 @MSLaguana] Update version number to 1.5.3
|
8 лет назад |
|
Jimmy Thomson
|
7be8d526f7
Update version number to 1.5.3
|
8 лет назад |
 Akrosh Gandhi
|
bd1dba2da8
[MERGE #3341 @akroshg] 17-07 ChakraCore servicing release
|
8 лет назад |
|
Akrosh Gandhi
|
9940903b29
excluded params.js to run on xplat
|
8 лет назад |
|
Akrosh Gandhi
|
8ffc999222
Fix arm prefast failure
|
8 лет назад |
|
Akrosh Gandhi
|
1f3a3f4e6b
Fixing prefast warning and copyright header error
|
8 лет назад |
|
Michael Ferris
|
8fafa37204
[CVE-2017-8603] Change how we handle return value for asm.js/wasm interpreter
|
8 лет назад |
|
Michael Ferris
|
6999714882
[CVE-2017-8604] Fix for stack allocation for asm.js/wasm
|
8 лет назад |
 Paul Leathers
|
2e514d7265
[CVE-2017-8609] On object pointer copy prop, check for mismatch between new pointer symbol and existing object type spec info. If there is a mismatch, then stale ObjTypeSpecFldInfo may lead to jitted code that accesses a bad address, so disable optimization of this load/store.
|
8 лет назад |
|
Paul Leathers
|
9326bda18a
[CVE-2017-8601] Generate bailouts for cases of typed array stores where conversion of the source value can cause implicit calls. For BailOutOnImplicitCalls, check implicit call bit on return from the conversion helper. For BailOutOnArrayAccessHelperCall, bail out instead of calling the conversion helper.
|
8 лет назад |
 Suwei Chen
|
39155400a7
[CVE-2017-8598] Uninitialized 'this' register
|
8 лет назад |
 Rajat Dua
|
f9795364cb
[CVE-2017-8610] Prevent loading bad function object for inlinees
|
8 лет назад |
 Jianchun Xu
|
e40a34fad7
[CVE-2017-8607] DictionaryTypeHandler property descriptor may contain invalid index
|
8 лет назад |
|
Jianchun Xu
|
7c3214efc8
[CVE-2017-8606, CVE-2017-8608] DictionaryTypeHandler nextPropertyIndex++ overflow
|
8 лет назад |
|
Akrosh Gandhi
|
f780a1157f
[CVE-2017-8619] Put failfast error on the OOM exception on certain places in the array APIs
|
8 лет назад |
 Oguz Bastemur
|
5d9535ac77
[MERGE #3190 @obastemur] xplat: fix ICU lib tilde path problem
|
8 лет назад |
|
Oguz Bastemur
|
d819d249e3
xplat: fix ICU lib tilde path problem
|
8 лет назад |
|
Jimmy Thomson
|
f91c91297d
[MERGE #3051 @MSLaguana] Updating release notes link
|
8 лет назад |
|
Jimmy Thomson
|
ccbc1ea527
Updating release notes link
|
8 лет назад |
|
Jianchun Xu
|
93ec291cff
[MERGE #3166 @jianchun] 17-06 ChakraCore servicing release
|
8 лет назад |
|
Jianchun Xu
|
86b66eefa6
fix some 17-06 build breaks and CI copyright check failure
|
8 лет назад |
 Meghana Gupta
|
bb95963a4a
[CVE-2017-8499] Fix expanding rest arguments during inlining
|
8 лет назад |
|
Rajat Dua
|
320547aabe
[CVE-2017-0228] Reallocate the last segment of a sparse array as a non-leaf, if necessary, before attempting to reverse the segment linked list
|
8 лет назад |
 Michael Holman
|
dd3e73bfec
[CVE-2017-8520] ensure that ServerScriptContext is unregistered before freeing
|
8 лет назад |
|
Paul Leathers
|
cd60f3b5c3
[CVE-2017-8548] In the case of a write to a typed array, the JIT emits inline code to do a bounds check. If the check fails, we convert the source value and jump to the end of the operation. But if the store should bail out on implicit calls, then we need to check for implicit calls caused by the conversion as well as the store itself.
|
8 лет назад |
|
Paul Leathers
|
b4f28f09d1
[CVE-2017-8524] Force addition of a data slot to the property descriptor when a global let/const property is added and a same-named global getter/setter already exists.
|
8 лет назад |
|
Paul Leathers
|
886a64c39c
[CVE-2017-8518] Use protected add operations when computing the length of a new frame display.
|
8 лет назад |
|
Jianchun Xu
|
8dc4469e4d
[CVE-2017-8522] TypeHandler invalid index reuse may cause buffer overrun
|
8 лет назад |
|
Jimmy Thomson
|
b3ec4b6344
Update version number to 1.5.2
|
8 лет назад |
