chakra-core / chakra-core/ChakraCore
seems a optimization bug when an object escaped
Open
Bug
Severity: 2
- Dominant language
- JavaScript
- Stars
- 9.3k
- Forks
- 1.2k
- PR merge metrics
- No merged PRs in 30d
Description
Seems only can effect the js code logic:
Maybe the stack obj memory should be discarded after the deep copy, and redirect the ref to the stack obj data to the new heap obj memory.
otherwise, the optimized code execution result "heap_arr[index] == stack_arr[index]" not true, which changed the code logic.
[seems_a_bug_but_not_security_one.js.txt](https://github.com/Microsoft/ChakraCore/files/2289215/seems_a_bug_but_not_security_one.js.txt)
Contributor guide
Assessment
This issue has not been assessed yet.