commit 8cd0e2fba8b916e268bc48a04b6ab19a4e523a04
author Rubin Xu <rubinxu@google.com> Fri Aug 02 15:32:06 2019 +0100
committer Max Spector <mspector@google.com> Wed Sep 18 17:14:22 2019 -0700
tree eabc9eb44864c9a9a60cf3349b69e2e271d9c4ff
parent 90feea47c8ad51fa246b0370dc0acb9eb57ddbfd

[DO NOT MERGE] Fix OOB Access

https://bugs.chromium.org/p/chromium/issues/detail?id=789764

Bug: 138442295
Test: m -j proxy_resolver_v8_unittest && adb sync && adb shell \
      /data/nativetest/proxy_resolver_v8_unittest/proxy_resolver_v8_unittest
Change-Id: I382ee8e0e3668d0e02cce91342fd5a24d42a0bfe
(cherry picked from commit a2b186599ba7194b365b945780f2b8ec01c851c0)

src/ast/ast-traversal-visitor.h

diff --git a/src/ast/ast-traversal-visitor.h b/src/ast/ast-traversal-visitor.h
index 6d0c386..3a102b4 100644
--- a/src/ast/ast-traversal-visitor.h
+++ b/src/ast/ast-traversal-visitor.h
@@ -245,6 +245,7 @@
 template <class Subclass>
 void AstTraversalVisitor<Subclass>::VisitForInStatement(ForInStatement* stmt) {
   PROCESS_NODE(stmt);
+  RECURSE(Visit(stmt->each()));
   RECURSE(Visit(stmt->enumerable()));
   RECURSE(Visit(stmt->body()));
 }

src/objects.cc

diff --git a/src/objects.cc b/src/objects.cc
index d5b7777..c2996ae 100644
--- a/src/objects.cc
+++ b/src/objects.cc
@@ -13168,8 +13168,8 @@
 
 MaybeHandle<SharedFunctionInfo> Script::FindSharedFunctionInfo(
     Isolate* isolate, const FunctionLiteral* fun) {
-  DCHECK_NE(fun->function_literal_id(), FunctionLiteral::kIdTypeInvalid);
-  DCHECK_LT(fun->function_literal_id(), shared_function_infos()->length());
+  CHECK_NE(fun->function_literal_id(), FunctionLiteral::kIdTypeInvalid);
+  CHECK_LT(fun->function_literal_id(), shared_function_infos()->length());
   Object* shared = shared_function_infos()->get(fun->function_literal_id());
   if (shared->IsUndefined(isolate) || WeakCell::cast(shared)->cleared()) {
     return MaybeHandle<SharedFunctionInfo>();