[CVE-2018-8390] Edge - Inlining a fixed deferred function can lead to…

… OOB read/write - Internal
chakra-core · Aug 14, 2018 · 63ae30a · 63ae30a
1 parent e9d6a3e
commit 63ae30a
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/lib/Backend/NativeCodeGenerator.cpp b/lib/Backend/NativeCodeGenerator.cpp
@@ -2848,7 +2848,7 @@ NativeCodeGenerator::GatherCodeGenData(
                 inlineCache->TryGetFixedMethodFromCache(functionBody, ldFldInlineCacheIndex, &fixedFunctionObject);
             }
 
-            if (fixedFunctionObject && !fixedFunctionObject->GetFunctionInfo()->IsDeferred() && fixedFunctionObject->GetFunctionBody() != inlineeFunctionBody)
+            if (fixedFunctionObject && fixedFunctionObject->GetFunctionInfo() != inlineeFunctionBody->GetFunctionInfo())
             {
                 fixedFunctionObject = nullptr;
             }