Merged: [turbofan] Fix memory corruption

MayaLekova · MayaLekova · commit a22b7b574757 · 2019-08-26T07:48:49.000Z
Revision: f16a3a7 BUG=chromium:997057 LOG=N NOTRY=true NOPRESUBMIT=true NOTREECHECKS=true R=hablich@chromium.org Change-Id: I179a853f4e8765d251ac59c2a31a554bc9bb0041 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1768362 Reviewed-by: Michael Hablich <hablich@chromium.org> Cr-Commit-Position: refs/branch-heads/7.7@{#12} Cr-Branched-From: 4035531-refs/heads/7.7.299@{#1} Cr-Branched-From: 1320c91-refs/heads/master@{#62881}
diff --git a/src/compiler/js-native-context-specialization.cc b/src/compiler/js-native-context-specialization.cc
@@ -1060,7 +1060,7 @@ Reduction JSNativeContextSpecialization::ReduceNamedAccess(
   Node* control = NodeProperties::GetControlInput(node);
 
   ZoneVector<PropertyAccessInfo> access_infos(zone());
-  AccessInfoFactory access_info_factory(broker(), dependencies(), zone());
+  AccessInfoFactory access_info_factory(broker(), dependencies(), graph()->zone());
   if (!access_info_factory.FinalizePropertyAccessInfos(
           feedback.access_infos(), access_mode, &access_infos)) {
     return NoChange();
@@ -1765,7 +1765,7 @@ Reduction JSNativeContextSpecialization::ReducePropertyAccess(
         if (name.has_value()) {
           ZoneVector<PropertyAccessInfo> access_infos(zone());
           AccessInfoFactory access_info_factory(broker(), dependencies(),
-                                                zone());
+                                                graph()->zone());
           access_info_factory.ComputePropertyAccessInfos(
               receiver_maps, name->object(), access_mode, &access_infos);
           processed = new (zone()) NamedAccessFeedback(*name, access_infos);
