[CVE-2020-0828]

lib/Backend/GlobOpt.cpp

@@ -2903,7 +2903,12 @@ GlobOpt::OptTagChecks(IR::Instr *instr)
                     // the byteCodeUse fields...
                     TrackByteCodeUsesForInstrAddedInOptInstr(bailOutInstr, [&]()
                     {
-                        TryHoistInvariant(bailOutInstr, this->currentBlock, nullptr, value, nullptr, true, false, false, IR::BailOutOnTaggedValue);
+                        if (TryHoistInvariant(bailOutInstr, this->currentBlock, nullptr, value, nullptr, true, false, false, IR::BailOutOnTaggedValue))
+                        {
+                            Value* landingPadValue = this->currentBlock->loop->landingPad->globOptData.FindValue(stackSym);
+                            ValueType newLandingPadValueType = landingPadValue->GetValueInfo()->Type().SetCanBeTaggedValue(false);
+                            ChangeValueType(nullptr, landingPadValue, newLandingPadValueType, false);
+                        }
                     });
                 }
                 if (symOpnd)

lib/Backend/GlobOptArrays.cpp

@@ -498,6 +498,13 @@ void GlobOpt::ArraySrcOpt::CheckLoops()
         if (doArrayChecks)
         {
             hoistChecksOutOfLoop = loop;
+
+            // If BailOnNotObject isn't hoisted, the value may still be tagged in the landing pad
+            if (baseValueInLoopLandingPad->GetValueInfo()->Type().CanBeTaggedValue())
+            {
+                baseValueType = baseValueType.SetCanBeTaggedValue(true);
+                baseOpnd->SetValueType(baseValueType);
+            }
         }
 
         if (isLikelyJsArray && loopKills.KillsArrayHeadSegments())