[CVE-2017-11840] [ChakraCore]: JIT: GlobOpt::OptTagChecks must consider IsLoopPrePass properly - Google, Inc.

meg-gupta · leirocks · commit 874551dd00ff · 2017-11-14T15:10:03.000-08:00
diff --git a/lib/Runtime/Language/ValueType.cpp b/lib/Runtime/Language/ValueType.cpp
@@ -1058,7 +1058,7 @@ ValueType ValueType::ToDefiniteNumber() const
 ValueType ValueType::ToDefiniteAnyNumber() const
 {
     // Not asserting on expected value type because Conv_Num allows converting values of arbitrary types to number
-    if(OneOn(Bits::Object))
+    if(OneOn(Bits::Object | Bits::PrimitiveOrObject))
         return Verify(Bits::Number | Bits::CanBeTaggedValue);
     Bits numberBits =
         bits &

Original file line number	Diff line number	Diff line change
`@@ -1058,7 +1058,7 @@ ValueType ValueType::ToDefiniteNumber() const`
`1058`	`1058`	`ValueType ValueType::ToDefiniteAnyNumber() const`
`1059`	`1059`	`{`
`1060`	`1060`	`// Not asserting on expected value type because Conv_Num allows converting values of arbitrary types to number`
`1061`		`- if(OneOn(Bits::Object))`
	`1061`	`+ if(OneOn(Bits::Object \| Bits::PrimitiveOrObject))`
`1062`	`1062`	`return Verify(Bits::Number \| Bits::CanBeTaggedValue);`
`1063`	`1063`	`Bits numberBits =`
`1064`	`1064`	`bits &`