Skip to content

Commit 0b26b3a

Browse files
mythriallemibrunin
authored andcommitted
[Backport] Security bug 1171954
Partial cherry-pick (leaving out tests) of patch originally reviewed on https://chromium-review.googlesource.com/c/v8/v8/+/2674008: Merged: [interpreter] Store accumulator to callee after optional chain checks Revision: df98901c19ce17ca995ee6750379b0f004210d68 BUG=chromium:1171954 NOTRY=true NOPRESUBMIT=true NOTREECHECKS=true [email protected] Change-Id: If09e1503ca07b47a112362495ec0bb9d502118c9 Reviewed-by: Ross McIlroy <[email protected]> Cr-Commit-Position: refs/branch-heads/8.9@{#33} Cr-Branched-From: 16b9bbbd581c25391981aa03180b76aa60463a3e-refs/heads/8.9.255@{#1} Cr-Branched-From: d16a2a688498bd1c3e6a49edb25d8c4ca56232dc-refs/heads/master@{#72039} Reviewed-by: Allan Sandfeld Jensen <[email protected]>
1 parent 472fd21 commit 0b26b3a

File tree

1 file changed

+2
-1
lines changed

1 file changed

+2
-1
lines changed

chromium/v8/src/interpreter/bytecode-generator.cc

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4921,8 +4921,9 @@ void BytecodeGenerator::VisitCall(Call* expr) {
49214921
Property* property = chain->expression()->AsProperty();
49224922
BuildOptionalChain([&]() {
49234923
VisitAndPushIntoRegisterList(property->obj(), &args);
4924-
VisitPropertyLoadForRegister(args.last_register(), property, callee);
4924+
VisitPropertyLoad(args.last_register(), property);
49254925
});
4926+
builder()->StoreAccumulatorInRegister(callee);
49264927
break;
49274928
}
49284929
case Call::SUPER_CALL:

0 commit comments

Comments
 (0)