Level 8
Problem
The elimination of CheckBounds node had been changed to:
- Assume
CheckBoundsnode has two input operand nodeindexandlength.- Each of them have a type labeled with their range
[min, max].
- Each of them have a type labeled with their range
- When
index.min >= 0.0 && index.min < length.min, theCheckBoundswill be eliminated.
Key Knowledge
- Bound Check Elimination based Out of Bound Access
- CVE-2020-9802
- Bound Check Elimination related Simplified Lowering Phase in V8
- Use this technique to corrupt array's length.
- Make JIT engine consider an unspeculated parameter as an integer
- Use bitwise operations