17-05 ChakraCore servicing release#2959

Merged

chakrabot merged 12 commits into

chakra-core:release/1.4from

rajatd:release/1705

May 12, 2017

Commits on May 10, 2017

[CVE-2017-0224, CVE-2017-0235] Chakra - JavascriptPromise::AsyncSpawnStep method invocation issue

aneeshdk
authored and
rajatd
committed
[CVE-2017-266] Protect store-element to a float typed array from implicit call if BailOutOnArrayAccessHelperCall is set, as that bailout kind indicates that downstream code will assume no side-effe…

pleath
authored and
rajatd
committed
[CVE-2017-0252] CopyNativeIntArrayElementsToVar overflow

Suwei Chen
authored and
rajatd
committed
[CVE-2017-0238] OOM in Array.unshift can leave array in an inconsistent state

Suwei Chen
authored and
rajatd
committed
[CVE-2017-0228] Segment bug in the ReverseHelper.

akroshg
authored and
rajatd
committed
[CVE-2017-0229] Non-blinded constants remaining in jit
rajatd
committed
[CVE-2017-0234] Too aggressive bound check removal
rajatd
committed
[CVE-2017-0236] Bug with array buffer detach
rajatd
committed
[CVE-2017-0223] Fix right paren location calculation for lambda with assignment expression
boingoing
committed
[CVE-2017-0230] Fix incorrect byte offset values for the class constructor parse node
boingoing
committed

Commits on May 11, 2017

Fix CI
rajatd
committed
Fix Prefast warning
rajatd
committed

⚡