{"push_id":2649274225,"size":74,"distinct_size":74,"ref":"refs/heads/master","head":"65c7ee9dc36137c45a3ec101cfc0637f75ab430a","before":"c9a6482126699d535210f9a667afa88350812cb8","commits":[{"sha":"de65f26b33ad0a53aa225f2314fc8b65a0eacff7","author":{"name":"rhuanjl","email":"b3e4f38ad359498175d53c8af1a5048431e5dfb2@gmail.com"},"message":"Implement -module flag in ch for running a script as a module.","distinct":true,"url":"https://api.github.com/repos/xiaoyinl/ChakraCore/commits/de65f26b33ad0a53aa225f2314fc8b65a0eacff7"},{"sha":"ba8820832d85dbe908d607e3a40ef8881df82286","author":{"name":"Mike Kaufman","email":"d668a0fa62e335373507db399d64bef13afbefe2@microsoft.com"},"message":"adding gc start and end reasons to gc telemetry collection","distinct":true,"url":"https://api.github.com/repos/xiaoyinl/ChakraCore/commits/ba8820832d85dbe908d607e3a40ef8881df82286"},{"sha":"f186f964837a85f8ebdc66c38200c34bf93d641f","author":{"name":"Mike Kaufman","email":"d668a0fa62e335373507db399d64bef13afbefe2@microsoft.com"},"message":"adding copyright headers","distinct":true,"url":"https://api.github.com/repos/xiaoyinl/ChakraCore/commits/f186f964837a85f8ebdc66c38200c34bf93d641f"},{"sha":"fc1fb6ab27384ddd93c5bbdecb4eedba63e8a7ad","author":{"name":"Xiaoyin Liu","email":"32df21de949e13491a65a7be3a6a12ee9758e8f8@users.noreply.github.com"},"message":"Fix potential buffer overread in CountNewlines in Scan.cpp\n\ncch parameter is ignored if psz is not null-terminated and psz[cch-1] == '\\r' and psz[cch] == '\\n'.","distinct":true,"url":"https://api.github.com/repos/xiaoyinl/ChakraCore/commits/fc1fb6ab27384ddd93c5bbdecb4eedba63e8a7ad"},{"sha":"590e7ce9d1359ac61521361d0dc27a71c76bfda3","author":{"name":"Xiaoyin Liu","email":"32df21de949e13491a65a7be3a6a12ee9758e8f8@users.noreply.github.com"},"message":"Remove cch parameter for CountNewlines in Scan.cpp\n\nAs commented by sethbrenith, all callers do not pass cch and use default -1, so\nthere's no need to keep cch.","distinct":true,"url":"https://api.github.com/repos/xiaoyinl/ChakraCore/commits/590e7ce9d1359ac61521361d0dc27a71c76bfda3"},{"sha":"8af718902bfdc23bdce67d013eb25bd73773e306","author":{"name":"Michael Holman","email":"e6a1f2ef8c2ac923267d2d8ff8e2354cf93e07a5@microsoft.com"},"message":"[CVE-2018-8227] Edge - Bad input to JIT process causes OOB write - Internal","distinct":true,"url":"https://api.github.com/repos/xiaoyinl/ChakraCore/commits/8af718902bfdc23bdce67d013eb25bd73773e306"},{"sha":"9b270c55bfea2fbefc9482d3414c4b4b395cad10","author":{"name":"Meghana Gupta","email":"7ca85fc13994ffb55c38aa18dc62d5c429699efa@microsoft.com"},"message":"[CVE-2018-8229] Edge - Chakra JIT Type confusion with hoisted SetConcatStrMultiItemBE instructions - Google, Inc.","distinct":true,"url":"https://api.github.com/repos/xiaoyinl/ChakraCore/commits/9b270c55bfea2fbefc9482d3414c4b4b395cad10"},{"sha":"c8abc36d55bc329c73711170084cfb9c8dda983a","author":{"name":"Paul Leathers","email":"d14bd2a22e4c8977e74f618bf3e054ee611d1aca@microsoft.com"},"message":"[CVE-2018-8236] Virtual typed array buffer read/written after free","distinct":true,"url":"https://api.github.com/repos/xiaoyinl/ChakraCore/commits/c8abc36d55bc329c73711170084cfb9c8dda983a"},{"sha":"2e7183babfb08b428f0932551d57e84a8d10bf3d","author":{"name":"Aneesh Divakarakurup","email":"02bad9fff592311bdbedd248e9b43d17c589cb57@microsoft.com"},"message":"Mark ExtendArg parameters as live on back edge in JIT loops\n\nFor HomeObj opcodes the helper call is done using ExtendArgs. When the ExtendArgs are hoisted outside the loop marking them as live on back edge to avoid being reused.","distinct":true,"url":"https://api.github.com/repos/xiaoyinl/ChakraCore/commits/2e7183babfb08b428f0932551d57e84a8d10bf3d"},{"sha":"99df6c9ea02186d83f5cd10b873eadfab5062807","author":{"name":"Aneesh Divakarakurup","email":"02bad9fff592311bdbedd248e9b43d17c589cb57@microsoft.com"},"message":"[MERGE #5277 @aneeshdk] Mark ExtendArg parameters as live on back edge in JIT loops\n\nMerge pull request #5277 from aneeshdk:HomeObjLowerBug\n\nFor HomeObj opcodes the helper call is done using ExtendArgs. When the ExtendArgs are hoisted outside the loop marking them as live on back edge to avoid being reused.","distinct":true,"url":"https://api.github.com/repos/xiaoyinl/ChakraCore/commits/99df6c9ea02186d83f5cd10b873eadfab5062807"},{"sha":"2f6e467f1ac7b19625cf659b1ac5e0df77b09fa0","author":{"name":"Doug Ilijev","email":"7d3ac0fbef8ca47f157298618fd81137a2a260bf@microsoft.com"},"message":"OS#16539423: rl -timeout <seconds> now only overrrides the XML timeout if -timeout is longer.","distinct":true,"url":"https://api.github.com/repos/xiaoyinl/ChakraCore/commits/2f6e467f1ac7b19625cf659b1ac5e0df77b09fa0"},{"sha":"7121b6b436c05b971f3081dd5a489727a52e15a9","author":{"name":"Meghana Gupta","email":"7ca85fc13994ffb55c38aa18dc62d5c429699efa@microsoft.com"},"message":"Don't merge profiled valutetype when valuetable's type is definite\n\nFixes OS#15189393","distinct":true,"url":"https://api.github.com/repos/xiaoyinl/ChakraCore/commits/7121b6b436c05b971f3081dd5a489727a52e15a9"},{"sha":"cb568a87a4595990454f2b7ec2199947f7cc4e6f","author":{"name":"Seth Brenith","email":"f68ddd5d605a88ca375ede11f76a23f9c83ead75@microsoft.com"},"message":"[MERGE #5290 @xiaoyinl] Fix potential buffer overread in CountNewlines in Scan.cpp\n\nMerge pull request #5290 from xiaoyinl:countnewlines\n\n`cch` parameter is ignored if `psz` is not null-terminated and `psz[cch-1] == '\\r'` and `psz[cch] == '\\n'`. For example, `CountNewlines(_u(\"ab\\r\\na\\n\\n\"), 3)` should return 1 (only count the first \\r), but it now returns 2 (the first \\r\\n is skipped but the trailing \\n\\n are counted). The problem is that the `break` at line 26 breaks the switch, and `cch` becomes -1.\n\nNo callers actually pass `cch`, so removing it.","distinct":true,"url":"https://api.github.com/repos/xiaoyinl/ChakraCore/commits/cb568a87a4595990454f2b7ec2199947f7cc4e6f"},{"sha":"e2e570ae48b004382fa32bbf5a6c71ca43ce80c2","author":{"name":"Rajat Dua","email":"8e6a37fdbb13f7b3e8290655a294b8b597754ebc@microsoft.com"},"message":"Catching typed array OOB AVs coming from stack allocated functions. OS #17785360","distinct":true,"url":"https://api.github.com/repos/xiaoyinl/ChakraCore/commits/e2e570ae48b004382fa32bbf5a6c71ca43ce80c2"},{"sha":"af35f2690756c50336473af6408dc9dd507f6c61","author":{"name":"Rajat Dua","email":"8e6a37fdbb13f7b3e8290655a294b8b597754ebc@microsoft.com"},"message":"[MERGE #5292 @rajatd] Catching typed array OOB AVs coming from stack allocated functions. OS #17785360\n\nMerge pull request #5292 from rajatd:stackfuncAV","distinct":true,"url":"https://api.github.com/repos/xiaoyinl/ChakraCore/commits/af35f2690756c50336473af6408dc9dd507f6c61"},{"sha":"bf7315294b0b9bd4ac981265ff4b5b42270d2a61","author":{"name":"Meghana Gupta","email":"7ca85fc13994ffb55c38aa18dc62d5c429699efa@microsoft.com"},"message":"[MERGE #5295 @meg-gupta] Don't merge profiled valutetype when valuetable's type is definite\n\nMerge pull request #5295 from meg-gupta:ldlenprofile\n\nWe should not merge valuetype from the value which is definite with a profiled valuetype. It can trigger merge of incompatible valuetypes.\n\nFixes OS#15189393","distinct":true,"url":"https://api.github.com/repos/xiaoyinl/ChakraCore/commits/bf7315294b0b9bd4ac981265ff4b5b42270d2a61"},{"sha":"9195b94de5997c68ba1d806dc9a60ae4d372e77c","author":{"name":"Taylor Woll","email":"a668024d3b6c7a4f56c4f4ae775313a1d9a80f13@ntdev.microsoft.com"},"message":"OS#17530048 - AssertMsg(i < this->Length(), \"index out of bound\") -- Chakra!BVFixed::AssertRange\n\nFunction count saved in the serialized bytecode is computed based on the total number of functions we visit and add to the bytecode. It is possible, though, for us to have a higher function id after defer parsing due to the reparse scenario we have for lambda argument lists. We avoid lambda parameter reparse when using the parser state cache except in the presence of default arguments. So serializing and running bytecode containing a lambda function with a default argument containing another function will increment the next function id to be greater than the size of the startup functions array in SourceDynamicProfileManager which will hit this assert.\n\nExample:\n```js\n(a = () => 1) => 2;\n(function(){})(); // <-- function id of this function is equal to the size of startupFunctions array\n```\n\nFix by serializing the function count from the source info instead of counting the functions we add to the bytecode one-by-one.\n\nFixes:\nhttps://microsoft.visualstudio.com/_workitems/edit/17530048\nhttps://microsoft.visualstudio.com/_workitems/edit/17529917","distinct":true,"url":"https://api.github.com/repos/xiaoyinl/ChakraCore/commits/9195b94de5997c68ba1d806dc9a60ae4d372e77c"},{"sha":"51692555d7e669d6c2cff7708502633a6342b266","author":{"name":"Taylor Woll","email":"a668024d3b6c7a4f56c4f4ae775313a1d9a80f13@ntdev.microsoft.com"},"message":"Add unit test","distinct":true,"url":"https://api.github.com/repos/xiaoyinl/ChakraCore/commits/51692555d7e669d6c2cff7708502633a6342b266"},{"sha":"65493e1b5e2c2b0a220835ac45732ae8e16eb076","author":{"name":"Paul Leathers","email":"d14bd2a22e4c8977e74f618bf3e054ee611d1aca@microsoft.com"},"message":"Make the engine respect -off:typepropertycache. The phase switch was only being used to enable tracing, not to disable the feature.","distinct":true,"url":"https://api.github.com/repos/xiaoyinl/ChakraCore/commits/65493e1b5e2c2b0a220835ac45732ae8e16eb076"},{"sha":"6c2c8a78420e9bcc0b126ea05a6f17237aff3415","author":{"name":"Taylor Woll","email":"a668024d3b6c7a4f56c4f4ae775313a1d9a80f13@ntdev.microsoft.com"},"message":"[MERGE #5288 @boingoing] OS#17530048 - AssertMsg(i < this->Length(), \"index out of bound\") -- Chakra!BVFixed::AssertRange\n\nMerge pull request #5288 from boingoing:correct_functioncount_bytecode\n\nFunction count saved in the serialized bytecode is computed based on the total number of functions we visit and add to the bytecode. It is possible, though, for us to have a higher function id after defer parsing due to the reparse scenario we have for lambda argument lists. We avoid lambda parameter reparse when using the parser state cache except in the presence of default arguments. So serializing and running bytecode containing a lambda function with a default argument containing another function will increment the next function id to be greater than the size of the startup functions array in SourceDynamicProfileManager which will hit this assert.\n\nExample:\n```js\n    (a = () => 1) => 2;\n    (function(){})(); // <-- function id of this function is equal to the size of startupFunctions array\n```\n\nFix by serializing the function count from the source info instead of counting the functions we add to the bytecode one-by-one.\n\nFixes:\n    https://microsoft.visualstudio.com/_workitems/edit/17530048\n    https://microsoft.visualstudio.com/_workitems/edit/17529917","distinct":true,"url":"https://api.github.com/repos/xiaoyinl/ChakraCore/commits/6c2c8a78420e9bcc0b126ea05a6f17237aff3415"}]}
{"actor":{"display_login":"xiaoyinl"}}