chakra-core / chakra-core/ChakraCore

seems a optimization bug when an object escaped

Open
#5,598 1 comment 0 reactions 0 assignees View on GitHub
Bug Severity: 2
Dominant language
JavaScript
Stars
9.3k
Forks
1.2k
PR merge metrics
No merged PRs in 30d

Description

Seems only can effect the js code logic:
Maybe the stack obj memory should be discarded after the deep copy, and redirect the ref to the stack obj data to the new heap obj memory.
otherwise, the optimized code execution result "heap_arr[index] == stack_arr[index]" not true, which changed the code logic.

[seems_a_bug_but_not_security_one.js.txt](https://github.com/Microsoft/ChakraCore/files/2289215/seems_a_bug_but_not_security_one.js.txt)

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.