[CVE-2020-0823]

Author: pleath

lib/Backend/GlobOptArrays.cpp

@@ -1711,9 +1711,7 @@ void GlobOpt::ArraySrcOpt::Optimize()
 
     baseOpnd->SetValueType(baseValueType);
 
-    if (!baseValueType.IsLikelyAnyOptimizedArray() ||
-        !globOpt->DoArrayCheckHoist(baseValueType, globOpt->currentBlock->loop, instr) ||
-        (baseOwnerIndir && !globOpt->ShouldExpectConventionalArrayIndexValue(baseOwnerIndir)))
+    if (!baseValueType.IsLikelyAnyOptimizedArray())
     {
         return;
     }
@@ -1728,6 +1726,16 @@ void GlobOpt::ArraySrcOpt::Optimize()
         return;
     }
 
+    if (!globOpt->DoArrayCheckHoist(baseValueType, globOpt->currentBlock->loop, instr) ||
+        (baseOwnerIndir && !globOpt->ShouldExpectConventionalArrayIndexValue(baseOwnerIndir)))
+    {
+        if (!globOpt->IsLoopPrePass() && baseValueType.IsAnyOptimizedArray())
+        {
+            globOpt->ProcessNoImplicitCallArrayUses(baseOpnd, nullptr, instr, isLikelyJsArray, isLoad || isStore || instr->m_opcode == Js::OpCode::IsIn);
+        }
+        return;
+    }
+
     isLikelyVirtualTypedArray = baseValueType.IsLikelyOptimizedVirtualTypedArray();
     Assert(!(isLikelyJsArray && isLikelyVirtualTypedArray));