Full title: Microsoft Edge Chakra JIT Failed RegexHelper::StringReplace Call Exploit 
Category: dos / poc
Platform: windows
The "String.prototype.replace" method can be inlined in the JIT process. So in the method, all the calls which may break the JIT assumptions must be invoked with updating "ImplicitCallFlags". But "RegexHelper::StringReplace" calls the replace function without updating the flag. Therefore it fails to detect if a user function was called.

# 0day.today @ http://0day.today/