Skip to content

Commit 67f4df0

Browse files
rajatdrajatd
committed
[MERGE #2959 @rajatd] 17-05 ChakraCore servicing release
Merge pull request #2959 from rajatd:release/1705 Fixes the following CVEs impacting ChakraCore: CVE-2017-0229 CVE-2017-0223 CVE-2017-0224 CVE-2017-0252 CVE-2017-0230 CVE-2017-0234 CVE-2017-0235 CVE-2017-0236 CVE-2017-0228 CVE-2017-0238 CVE-2017-0266
2 parents 922263e + b3aeb30 commit 67f4df0

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

46 files changed

+775
-132
lines changed

‎lib/Backend/Func.cpp‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -322,6 +322,11 @@ Func::Codegen(JitArenaAllocator *alloc, JITTimeWorkItem * workItem,
322322
workItem->GetJITFunctionBody()->GetProfileInfo()->DisableSwitchOpt();
323323
outputData->disableSwitchOpt = TRUE;
324324
}
325+
else if (ex.Reason() == RejitReason::ArrayCheckHoistDisabled || ex.Reason() == RejitReason::ArrayAccessHelperCallEliminationDisabled)
326+
{
327+
workItem->GetJITFunctionBody()->GetProfileInfo()->DisableArrayCheckHoist(func.IsLoopBody());
328+
outputData->disableArrayCheckHoist = TRUE;
329+
}
325330
else
326331
{
327332
Assert(ex.Reason() == RejitReason::TrackIntOverflowDisabled);

‎lib/Backend/GlobOpt.cpp‎

Lines changed: 42 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -16014,7 +16014,7 @@ GlobOpt::AttachBoundsCheckData(IR::Instr* instr, IR::Opnd* lowerBound, IR::Opnd*
1601416014
instr->SetSrc2(upperBound);
1601516015
if (offset != 0)
1601616016
{
16017-
instr->SetDst(IR::IntConstOpnd::New(offset, TyInt32, instr->m_func, true));
16017+
instr->SetDst(IR::IntConstOpnd::New(offset, TyInt32, instr->m_func));
1601816018
}
1601916019
return instr;
1602016020
}
@@ -16338,9 +16338,37 @@ GlobOpt::OptArraySrc(IR::Instr * *const instrRef)
1633816338
)
1633916339
)
1634016340
{
16341-
eliminatedLowerBoundCheck = true;
16342-
eliminatedUpperBoundCheck = true;
16343-
canBailOutOnArrayAccessHelperCall = false;
16341+
// Unless we're in asm.js (where it is guaranteed that virtual typed array accesses cannot read/write beyond 4GB),
16342+
// check the range of the index to make sure we won't access beyond the reserved memory beforing eliminating bounds
16343+
// checks in jitted code.
16344+
if (!GetIsAsmJSFunc())
16345+
{
16346+
IR::RegOpnd * idxOpnd = baseOwnerIndir->GetIndexOpnd();
16347+
if (idxOpnd)
16348+
{
16349+
StackSym * idxSym = idxOpnd->m_sym->IsTypeSpec() ? idxOpnd->m_sym->GetVarEquivSym(nullptr) : idxOpnd->m_sym;
16350+
Value * idxValue = FindValue(idxSym);
16351+
IntConstantBounds idxConstantBounds;
16352+
if (idxValue && idxValue->GetValueInfo()->TryGetIntConstantBounds(&idxConstantBounds))
16353+
{
16354+
BYTE indirScale = Lowerer::GetArrayIndirScale(baseValueType);
16355+
int32 upperBound = idxConstantBounds.UpperBound();
16356+
int32 lowerBound = idxConstantBounds.LowerBound();
16357+
if (lowerBound >= 0 && ((static_cast<uint64>(upperBound) << indirScale) < MAX_ASMJS_ARRAYBUFFER_LENGTH))
16358+
{
16359+
eliminatedLowerBoundCheck = true;
16360+
eliminatedUpperBoundCheck = true;
16361+
canBailOutOnArrayAccessHelperCall = false;
16362+
}
16363+
}
16364+
}
16365+
}
16366+
else
16367+
{
16368+
eliminatedLowerBoundCheck = true;
16369+
eliminatedUpperBoundCheck = true;
16370+
canBailOutOnArrayAccessHelperCall = false;
16371+
}
1634416372
}
1634516373
}
1634616374

@@ -17307,8 +17335,7 @@ GlobOpt::OptArraySrc(IR::Instr * *const instrRef)
1730717335
: IR::IntConstOpnd::New(
1730817336
hoistInfo.IndexConstantBounds().LowerBound(),
1730917337
TyInt32,
17310-
instr->m_func,
17311-
true);
17338+
instr->m_func);
1731217339
lowerBound->SetIsJITOptimizedReg(true);
1731317340
IR::Opnd* upperBound = IR::RegOpnd::New(headSegmentLengthSym, headSegmentLengthSym->GetType(), instr->m_func);
1731417341
upperBound->SetIsJITOptimizedReg(true);
@@ -17456,7 +17483,7 @@ GlobOpt::OptArraySrc(IR::Instr * *const instrRef)
1745617483
{
1745717484
IR::Opnd* lowerBound = baseOwnerIndir->GetIndexOpnd()
1745817485
? static_cast<IR::Opnd *>(baseOwnerIndir->GetIndexOpnd())
17459-
: IR::IntConstOpnd::New(baseOwnerIndir->GetOffset(), TyInt32, instr->m_func, true);
17486+
: IR::IntConstOpnd::New(baseOwnerIndir->GetOffset(), TyInt32, instr->m_func);
1746017487
lowerBound->SetIsJITOptimizedReg(true);
1746117488
IR::Opnd* upperBound = IR::RegOpnd::New(headSegmentLengthSym, headSegmentLengthSym->GetType(), instr->m_func);
1746217489
upperBound->SetIsJITOptimizedReg(true);
@@ -20053,6 +20080,12 @@ GlobOpt::DoArrayLengthHoist() const
2005320080
return doArrayLengthHoist;
2005420081
}
2005520082

20083+
bool
20084+
GlobOpt::DoEliminateArrayAccessHelperCall(Func *const func)
20085+
{
20086+
return DoArrayCheckHoist(func);
20087+
}
20088+
2005620089
bool
2005720090
GlobOpt::DoEliminateArrayAccessHelperCall() const
2005820091
{
@@ -21400,7 +21433,7 @@ GlobOpt::GenerateInductionVariableChangeForMemOp(Loop *loop, byte unroll, IR::In
2140021433
{
2140121434
sizeOpnd = IR::RegOpnd::New(TyUint32, this->func);
2140221435

21403-
IR::Opnd *unrollOpnd = IR::IntConstOpnd::New(unroll, type, localFunc, true);
21436+
IR::Opnd *unrollOpnd = IR::IntConstOpnd::New(unroll, type, localFunc);
2140421437

2140521438
InsertInstr(IR::Instr::New(Js::OpCode::Mul_I4,
2140621439
sizeOpnd,
@@ -21413,7 +21446,7 @@ GlobOpt::GenerateInductionVariableChangeForMemOp(Loop *loop, byte unroll, IR::In
2141321446
else
2141421447
{
2141521448
uint size = (loopCount->LoopCountMinusOneConstantValue() + 1) * unroll;
21416-
sizeOpnd = IR::IntConstOpnd::New(size, IRType::TyUint32, localFunc, true);
21449+
sizeOpnd = IR::IntConstOpnd::New(size, IRType::TyUint32, localFunc);
2141721450
}
2141821451
loop->memOpInfo->inductionVariableOpndPerUnrollMap->Add(unroll, sizeOpnd);
2141921452
return sizeOpnd;

‎lib/Backend/GlobOpt.h‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1616,6 +1616,7 @@ class GlobOpt
16161616
static bool DoArrayMissingValueCheckHoist(Func *const func);
16171617
static bool DoArraySegmentHoist(const ValueType baseValueType, Func *const func);
16181618
static bool DoArrayLengthHoist(Func *const func);
1619+
static bool DoEliminateArrayAccessHelperCall(Func* func);
16191620
static bool DoTypedArrayTypeSpec(Func* func);
16201621
static bool DoNativeArrayTypeSpec(Func* func);
16211622
static bool IsSwitchOptEnabled(Func* func);

‎lib/Backend/IRBuilder.cpp‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -4879,14 +4879,14 @@ IRBuilder::BuildAuxiliary(Js::OpCode newOpcode, uint32 offset)
48794879
// The property ID array needs to be both relocatable and available (so we can
48804880
// get the slot capacity), so we need to just pass the offset to lower and let
48814881
// lower take it from there...
4882-
srcOpnd = IR::IntConstOpnd::New(auxInsn->Offset, TyUint32, m_func, true);
4882+
srcOpnd = IR::IntConstOpnd::New(auxInsn->Offset, TyUint32, m_func);
48834883
dstOpnd = this->BuildDstOpnd(dstRegSlot);
48844884
dstOpnd->SetValueType(ValueType::GetObject(ObjectType::UninitializedObject));
48854885
instr = IR::Instr::New(newOpcode, dstOpnd, srcOpnd, m_func);
48864886

48874887
// Because we're going to be making decisions based off the value, we have to defer
48884888
// this until we get to lowering.
4889-
instr->SetSrc2(IR::IntConstOpnd::New(literalObjectId, TyUint32, m_func, true));
4889+
instr->SetSrc2(IR::IntConstOpnd::New(literalObjectId, TyUint32, m_func));
48904890

48914891
if (dstOpnd->m_sym->m_isSingleDef)
48924892
{

‎lib/Backend/JITTimeProfileInfo.cpp‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -143,6 +143,12 @@ JITTimeProfileInfo::DisableAggressiveIntTypeSpec(bool isLoopBody)
143143
m_profileData.flags |= isLoopBody ? Flags_disableAggressiveIntTypeSpec_jitLoopBody : Flags_disableAggressiveIntTypeSpec;
144144
}
145145

146+
void
147+
JITTimeProfileInfo::DisableArrayCheckHoist(bool isLoopBody)
148+
{
149+
m_profileData.flags |= isLoopBody ? Flags_disableArrayCheckHoist_jitLoopBody : Flags_disableArrayCheckHoist;
150+
}
151+
146152
void
147153
JITTimeProfileInfo::DisableStackArgOpt()
148154
{

‎lib/Backend/JITTimeProfileInfo.h‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -40,6 +40,7 @@ class JITTimeProfileInfo
4040
void DisableStackArgOpt();
4141
void DisableSwitchOpt();
4242
void DisableTrackCompoundedIntOverflow();
43+
void DisableArrayCheckHoist(bool isLoopBody);
4344

4445
bool IsModulusOpByPowerOf2(Js::ProfileId profileId) const;
4546
bool IsAggressiveIntTypeSpecDisabled(const bool isJitLoopBody) const;

‎lib/Backend/Lower.cpp‎

Lines changed: 8 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -12858,7 +12858,7 @@ void Lowerer::LowerBoundCheck(IR::Instr *const instr)
1285812858
true,
1285912859
addResultOpnd,
1286012860
rightOpnd,
12861-
offsetOpnd ? offsetOpnd->UseWithNewType(TyInt32, func) : IR::IntConstOpnd::New(offset, TyInt32, func, true),
12861+
offsetOpnd ? offsetOpnd->UseWithNewType(TyInt32, func) : IR::IntConstOpnd::New(offset, TyInt32, func),
1286212862
insertBeforeInstr);
1286312863
InsertBranch(LowererMD::MDOverflowBranchOpcode, bailOutLabel, insertBeforeInstr);
1286412864

@@ -12870,7 +12870,7 @@ void Lowerer::LowerBoundCheck(IR::Instr *const instr)
1287012870
// $bailOut:
1287112871
if(!rightOpnd)
1287212872
{
12873-
rightOpnd = IR::IntConstOpnd::New(offset, TyInt32, func, true);
12873+
rightOpnd = IR::IntConstOpnd::New(offset, TyInt32, func);
1287412874
}
1287512875
InsertCompareBranch(leftOpnd, rightOpnd, compareOpCode, doUnsignedCompare, skipBailOutLabel, insertBeforeInstr);
1287612876
}
@@ -16874,16 +16874,18 @@ Lowerer::GenerateFastStElemI(IR::Instr *& stElem, bool *instrIsInHelperBlockRef)
1687416874
const IR::AutoReuseOpnd autoReuseReg(reg, m_func);
1687516875
InsertMove(reg, src, stElem);
1687616876

16877+
bool bailOutOnHelperCall = stElem->HasBailOutInfo() && (stElem->GetBailOutKind() & IR::BailOutOnArrayAccessHelperCall);
16878+
1687716879
// Convert to float, and assign to indirOpnd
1687816880
if (baseValueType.IsLikelyOptimizedVirtualTypedArray())
1687916881
{
1688016882
IR::RegOpnd* dstReg = IR::RegOpnd::New(indirOpnd->GetType(), this->m_func);
16881-
m_lowererMD.EmitLoadFloat(dstReg, reg, stElem);
16883+
m_lowererMD.EmitLoadFloat(dstReg, reg, stElem, bailOutOnHelperCall);
1688216884
InsertMove(indirOpnd, dstReg, stElem);
1688316885
}
1688416886
else
1688516887
{
16886-
m_lowererMD.EmitLoadFloat(indirOpnd, reg, stElem);
16888+
m_lowererMD.EmitLoadFloat(indirOpnd, reg, stElem, bailOutOnHelperCall);
1688716889
}
1688816890

1688916891
}
@@ -20569,7 +20571,7 @@ bool Lowerer::GenerateFastEqBoolInt(IR::Instr * instr, bool *pNeedHelper)
2056920571
// If it's not zero, then it's either 1, in which case it's true, or it's something else, in which
2057020572
// case the two will compare as inequal
2057120573
InsertCompareBranch(
20572-
IR::IntConstOpnd::New((((IntConstType)1) << Js::VarTag_Shift) + Js::AtomTag, IRType::TyVar, this->m_func),
20574+
IR::IntConstOpnd::New((((IntConstType)1) << Js::VarTag_Shift) + Js::AtomTag, IRType::TyVar, this->m_func, true),
2057320575
srcInt->AsRegOpnd(),
2057420576
Js::OpCode::BrNeq_A,
2057520577
isBranchNotCompare ? inequalResultTarget : forceInequal, // in the case of branching, we can go straight to the inequal target; for compares, we need to load the value
@@ -23889,7 +23891,7 @@ void Lowerer::GenerateSingleCharStrJumpTableLookup(IR::Instr * instr)
2388923891

2389023892
// CMP charOpnd, lastCaseIndex - baseCaseIndex
2389123893
// JA defaultLabel
23892-
InsertCompareBranch(charOpnd, IR::IntConstOpnd::New(multiBrInstr->m_lastCaseValue - multiBrInstr->m_baseCaseValue, TyUint32, func, true),
23894+
InsertCompareBranch(charOpnd, IR::IntConstOpnd::New(multiBrInstr->m_lastCaseValue - multiBrInstr->m_baseCaseValue, TyUint32, func),
2389323895
Js::OpCode::BrGt_A, true, defaultLabelInstr, instr);
2389423896

2389523897
instr->UnlinkSrc1();

‎lib/Backend/LowerMDShared.cpp‎

Lines changed: 44 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1257,7 +1257,7 @@ void LowererMD::ChangeToShift(IR::Instr *const instr, const bool needFlags)
12571257
}
12581258
}
12591259

1260-
void LowererMD::ChangeToMul(IR::Instr *const instr, bool hasOverflowCheck)
1260+
void LowererMD::ChangeToIMul(IR::Instr *const instr, bool hasOverflowCheck)
12611261
{
12621262
// If non-32 bit overflow check is needed, we have to use the IMUL form.
12631263
if (hasOverflowCheck && !instr->ShouldCheckFor32BitOverflow() && instr->ShouldCheckForNon32BitOverflow())
@@ -1272,8 +1272,29 @@ void LowererMD::ChangeToMul(IR::Instr *const instr, bool hasOverflowCheck)
12721272
{
12731273
// MOV reg, imm
12741274
temp2 = IR::RegOpnd::New(TyInt32, instr->m_func);
1275+
1276+
IR::Opnd * src2 = instr->GetSrc2();
1277+
bool dontEncode = false;
1278+
if (src2->IsHelperCallOpnd())
1279+
{
1280+
dontEncode = true;
1281+
}
1282+
else if (src2->IsIntConstOpnd() || src2->IsAddrOpnd())
1283+
{
1284+
dontEncode = src2->IsIntConstOpnd() ? src2->AsIntConstOpnd()->m_dontEncode : src2->AsAddrOpnd()->m_dontEncode;
1285+
}
1286+
else if (src2->IsInt64ConstOpnd())
1287+
{
1288+
dontEncode = false;
1289+
}
1290+
else
1291+
{
1292+
AssertMsg(false, "Unexpected immediate opnd");
1293+
throw Js::OperationAbortedException();
1294+
}
1295+
12751296
instr->InsertBefore(IR::Instr::New(Js::OpCode::MOV, temp2,
1276-
IR::IntConstOpnd::New((IntConstType)instr->GetSrc2()->GetImmediateValue(instr->m_func), TyInt32, instr->m_func, true),
1297+
IR::IntConstOpnd::New((IntConstType)instr->GetSrc2()->GetImmediateValue(instr->m_func), TyInt32, instr->m_func, dontEncode),
12771298
instr->m_func));
12781299
}
12791300
// eax = IMUL eax, reg
@@ -2061,7 +2082,7 @@ void LowererMD::LegalizeSrc(IR::Instr *const instr, IR::Opnd *src, const uint fo
20612082
if (!instr->isInlineeEntryInstr)
20622083
{
20632084
Assert(forms & L_Reg);
2064-
IR::IntConstOpnd * newIntOpnd = IR::IntConstOpnd::New(intOpnd->GetValue(), intOpnd->GetType(), instr->m_func, true);
2085+
IR::IntConstOpnd * newIntOpnd = intOpnd->Copy(instr->m_func)->AsIntConstOpnd();
20652086
IR::IndirOpnd * indirOpnd = instr->m_func->GetTopFunc()->GetConstantAddressIndirOpnd(intOpnd->GetValue(), newIntOpnd, IR::AddrOpndKindConstantAddress, TyMachPtr, Js::OpCode::MOV);
20662087
if (HoistLargeConstant(indirOpnd, src, instr))
20672088
{
@@ -2125,7 +2146,7 @@ void LowererMD::LegalizeSrc(IR::Instr *const instr, IR::Opnd *src, const uint fo
21252146
Assert(!instr->isInlineeEntryInstr);
21262147
Assert(forms & L_Reg);
21272148
// TODO: michhol, remove cast after making m_address intptr
2128-
IR::AddrOpnd * newAddrOpnd = IR::AddrOpnd::New(addrOpnd->m_address, addrOpnd->GetAddrOpndKind(), instr->m_func, true);
2149+
IR::AddrOpnd * newAddrOpnd = addrOpnd->Copy(instr->m_func)->AsAddrOpnd();
21292150
IR::IndirOpnd * indirOpnd = instr->m_func->GetTopFunc()->GetConstantAddressIndirOpnd((intptr_t)addrOpnd->m_address, newAddrOpnd, addrOpnd->GetAddrOpndKind(), TyMachPtr, Js::OpCode::MOV);
21302151
if (HoistLargeConstant(indirOpnd, src, instr))
21312152
{
@@ -6645,7 +6666,7 @@ LowererMD::EmitLoadFloatCommon(IR::Opnd *dst, IR::Opnd *src, IR::Instr *insertIn
66456666
}
66466667

66476668
IR::RegOpnd *
6648-
LowererMD::EmitLoadFloat(IR::Opnd *dst, IR::Opnd *src, IR::Instr *insertInstr)
6669+
LowererMD::EmitLoadFloat(IR::Opnd *dst, IR::Opnd *src, IR::Instr *insertInstr, bool bailOutOnHelperCall)
66496670
{
66506671
IR::LabelInstr *labelDone;
66516672
IR::Instr *instr;
@@ -6657,6 +6678,23 @@ LowererMD::EmitLoadFloat(IR::Opnd *dst, IR::Opnd *src, IR::Instr *insertInstr)
66576678
return nullptr;
66586679
}
66596680

6681+
if (bailOutOnHelperCall)
6682+
{
6683+
if(!GlobOpt::DoEliminateArrayAccessHelperCall(this->m_func))
6684+
{
6685+
// Array access helper call removal is already off for some reason. Prevent trying to rejit again
6686+
// because it won't help and the same thing will happen again. Just abort jitting this function.
6687+
if(PHASE_TRACE(Js::BailOutPhase, this->m_func))
6688+
{
6689+
Output::Print(_u(" Aborting JIT because EliminateArrayAccessHelperCall is already off\n"));
6690+
Output::Flush();
6691+
}
6692+
throw Js::OperationAbortedException();
6693+
}
6694+
6695+
throw Js::RejitException(RejitReason::ArrayAccessHelperCallEliminationDisabled);
6696+
}
6697+
66606698
IR::Opnd *memAddress = dst;
66616699

66626700
if (dst->IsRegOpnd())
@@ -7219,7 +7257,7 @@ LowererMD::LowerInt4MulWithBailOut(
72197257
// Lower the instruction
72207258
if (!simplifiedMul)
72217259
{
7222-
LowererMD::ChangeToMul(instr, needsOverflowCheck);
7260+
LowererMD::ChangeToIMul(instr, needsOverflowCheck);
72237261
}
72247262

72257263
const auto insertBeforeInstr = checkForNegativeZeroLabel ? checkForNegativeZeroLabel : bailOutLabel;

‎lib/Backend/LowerMDShared.h‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -50,7 +50,7 @@ class LowererMD
5050
static void ChangeToAdd(IR::Instr *const instr, const bool needFlags);
5151
static void ChangeToSub(IR::Instr *const instr, const bool needFlags);
5252
static void ChangeToShift(IR::Instr *const instr, const bool needFlags);
53-
static void ChangeToMul(IR::Instr *const instr, const bool hasOverflowCheck = false);
53+
static void ChangeToIMul(IR::Instr *const instr, const bool hasOverflowCheck = false);
5454
static const uint16 GetFormalParamOffset();
5555
static const Js::OpCode MDUncondBranchOpcode;
5656
static const Js::OpCode MDExtend32Opcode;
@@ -222,7 +222,7 @@ class LowererMD
222222
static IR::Instr *InsertConvertFloat64ToInt32(const RoundMode roundMode, IR::Opnd *const dst, IR::Opnd *const src, IR::Instr *const insertBeforeInstr);
223223
void ConvertFloatToInt32(IR::Opnd* intOpnd, IR::Opnd* floatOpnd, IR::LabelInstr * labelHelper, IR::LabelInstr * labelDone, IR::Instr * instInsert);
224224
void EmitLoadFloatFromNumber(IR::Opnd *dst, IR::Opnd *src, IR::Instr *insertInstr);
225-
IR::RegOpnd * EmitLoadFloat(IR::Opnd *dst, IR::Opnd *src, IR::Instr *insertInstr);
225+
IR::RegOpnd * EmitLoadFloat(IR::Opnd *dst, IR::Opnd *src, IR::Instr *insertInstr, bool bailOutOnHelperCall = false);
226226
static void EmitNon32BitOvfCheck(IR::Instr *instr, IR::Instr *insertInstr, IR::LabelInstr* bailOutLabel);
227227

228228
static void LowerInt4NegWithBailOut(IR::Instr *const instr, const IR::BailOutKind bailOutKind, IR::LabelInstr *const bailOutLabel, IR::LabelInstr *const skipBailOutLabel);

‎lib/Backend/NativeCodeGenerator.cpp‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1135,6 +1135,10 @@ NativeCodeGenerator::CodeGen(PageAllocator * pageAllocator, CodeGenWorkItem* wor
11351135

11361136
if (body->HasDynamicProfileInfo())
11371137
{
1138+
if (jitWriteData.disableArrayCheckHoist)
1139+
{
1140+
body->GetAnyDynamicProfileInfo()->DisableArrayCheckHoist(workItem->Type() == JsLoopBodyWorkItemType);
1141+
}
11381142
if (jitWriteData.disableAggressiveIntTypeSpec)
11391143
{
11401144
body->GetAnyDynamicProfileInfo()->DisableAggressiveIntTypeSpec(workItem->Type() == JsLoopBodyWorkItemType);

0 commit comments

Comments
 (0)