[SAB] Validate index before value conversion

src/compiler/ia32/instruction-selector-ia32.cc

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/base/adapters.h"
 #include "src/compiler/instruction-selector-impl.h"
 #include "src/compiler/node-matchers.h"
 #include "src/compiler/node-properties.h"
 
 namespace v8 {
@@ skipping 1846 matching lines @@
   } else if (type == MachineType::Int32() || type == MachineType::Uint32()) {
     opcode = word32_op;
   } else {
     UNREACHABLE();
     return;
   }
   InstructionOperand outputs[1];
   AddressingMode addressing_mode;
   InstructionOperand inputs[3];
   size_t input_count = 0;
-  if (type == MachineType::Int8() || type == MachineType::Uint8()) {
-    inputs[input_count++] = g.UseByteRegister(value);
-  } else {
-    inputs[input_count++] = g.UseUniqueRegister(value);
-  }
+  inputs[input_count++] = g.UseUniqueRegister(value);
   inputs[input_count++] = g.UseUniqueRegister(base);
   if (g.CanBeImmediate(index)) {
     inputs[input_count++] = g.UseImmediate(index);
     addressing_mode = kMode_MRI;
   } else {
     inputs[input_count++] = g.UseUniqueRegister(index);
     addressing_mode = kMode_MR1;
   }
   outputs[0] = g.DefineAsFixed(node, eax);
   InstructionOperand temp[1];
-  temp[0] = g.TempRegister();
+  if (type == MachineType::Int8() || type == MachineType::Uint8()) {
+    temp[0] = g.UseByteRegister(node);
+  } else {
+    temp[0] = g.TempRegister();
+  }
   InstructionCode code = opcode | AddressingModeField::encode(addressing_mode);
   Emit(code, 1, outputs, input_count, inputs, 1, temp);
 }
 
 #define VISIT_ATOMIC_BINOP(op)                                              \
   void InstructionSelector::VisitAtomic##op(Node* node) {                   \
     VisitAtomicBinaryOperation(node, kAtomic##op##Int8, kAtomic##op##Uint8, \
                                kAtomic##op##Int16, kAtomic##op##Uint16,     \
                                kAtomic##op##Word32);                        \
   }
@@ skipping 56 matching lines @@
 // static
 MachineOperatorBuilder::AlignmentRequirements
 InstructionSelector::AlignmentRequirements() {
   return MachineOperatorBuilder::AlignmentRequirements::
       FullUnalignedAccessSupport();
 }
 
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8