[CVE-2017-11914] JavascriptGeneratorFunction::GetPropertyBuiltIns exp…

…oses scriptFunction - Google, Inc.

While trying to get the length property pass the generator function as this not the inner script function.

lib/Runtime/Library/JavascriptGeneratorFunction.cpp

@@ -307,7 +307,7 @@ namespace Js
             // to get the length from our private ScriptFunction instead of ourself.
             int len = 0;
             Var varLength;
-            if (scriptFunction->GetProperty(scriptFunction, PropertyIds::length, &varLength, NULL, requestContext))
+            if (scriptFunction->GetProperty(this, PropertyIds::length, &varLength, NULL, requestContext))
             {
                 len = JavascriptConversion::ToInt32(varLength, requestContext);
             }